Security log on \\MSEDGEWIN10:
5181,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:28:56 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5180,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:28:56 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5179,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:28:33 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5178,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:28:33 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5177,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:28:17 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xc5426    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: WDAGUtilityAccount   Target Account Domain: MSEDGEWIN10  "
5176,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:28:17 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xc5426    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: sshd_server   Target Account Domain: MSEDGEWIN10  "
5175,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:28:17 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xc5426    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: sshd   Target Account Domain: MSEDGEWIN10  "
5174,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:28:17 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xc5426    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Guest   Target Account Domain: MSEDGEWIN10  "
5173,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:28:17 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xc5426    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: DefaultAccount   Target Account Domain: MSEDGEWIN10  "
5172,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:28:17 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xc5426    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Administrator   Target Account Domain: MSEDGEWIN10  "
5171,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:26:30 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5170,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:26:30 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5169,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:22:56 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5168,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:22:56 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5167,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:22:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5166,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:22:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5165,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:22:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x16b0   Process Name:  C:\Windows\System32\VSSVC.exe  "
5164,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:22:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x16b0   Process Name:  C:\Windows\System32\VSSVC.exe  "
5163,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:22:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x16b0   Process Name:  C:\Windows\System32\VSSVC.exe  "
5162,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:22:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x16b0   Process Name:  C:\Windows\System32\VSSVC.exe  "
5161,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:22:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x16b0   Process Name:  C:\Windows\System32\VSSVC.exe  "
5160,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:22:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x16b0   Process Name:  C:\Windows\System32\VSSVC.exe  "
5159,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:22:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x16b0   Process Name:  C:\Windows\System32\VSSVC.exe  "
5158,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:22:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x16b0   Process Name:  C:\Windows\System32\VSSVC.exe  "
5157,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:22:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5156,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:22:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5155,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:16:23 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5154,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:16:23 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5153,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:16:18 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5152,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:16:18 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5151,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:08:42 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5150,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:08:42 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5149,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:08:37 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x1018   Process Name:  C:\Windows\System32\svchost.exe  "
5148,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:08:37 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x1018   Process Name:  C:\Windows\System32\svchost.exe  "
5147,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:08:33 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5146,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:08:33 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5145,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:08:28 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5144,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:08:28 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5143,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:08:28 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5142,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:08:28 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5141,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:07:10 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5140,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:07:10 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5139,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:06:25 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5138,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:06:25 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5137,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:06:10 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5136,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:06:10 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5135,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:06:08 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5134,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:06:08 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5133,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:06:08 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x48c   Process Name:  C:\Windows\System32\svchost.exe  "
5132,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:06:08 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5131,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:06:08 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5130,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:06:07 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xc5407    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5129,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:06:07 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xc5426   Linked Logon ID:  0xc5407   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x548   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5128,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:06:07 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xc5407   Linked Logon ID:  0xc5426   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x548   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5127,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 7:06:07 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x548   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
5126,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:56:38 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5125,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:56:38 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5124,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:56:14 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5123,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:56:14 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5122,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:56:13 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5121,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:56:13 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5120,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:56:13 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5119,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:56:13 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5118,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:56:13 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5117,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:56:13 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5116,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:49:25 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5115,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:49:25 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5114,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:49:25 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5113,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:49:25 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5112,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:48:48 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xc64   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
5111,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:48:48 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xc64   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
5110,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:48:46 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5109,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:48:46 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5108,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:48:45 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x9a4   Process Name:  C:\Windows\System32\svchost.exe  "
5107,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:48:45 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x9a4   Process Name:  C:\Windows\System32\svchost.exe  "
5106,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:48:43 AM,5059,None,"Key migration operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Additional Information:   Operation: Export of persistent cryptographic key.     Return Code: 0x0  "
5105,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:48:43 AM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
5104,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:48:43 AM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Key File Operation Information:   File Path: C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
5103,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:48:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5102,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:48:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5101,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:47:16 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5100,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:47:16 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5099,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:47:13 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5098,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:47:13 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5097,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:47:05 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x438   Process Name:  C:\Windows\System32\VSSVC.exe  "
5096,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:47:05 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x438   Process Name:  C:\Windows\System32\VSSVC.exe  "
5095,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:47:05 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x438   Process Name:  C:\Windows\System32\VSSVC.exe  "
5094,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:47:05 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x438   Process Name:  C:\Windows\System32\VSSVC.exe  "
5093,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:47:05 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x438   Process Name:  C:\Windows\System32\VSSVC.exe  "
5092,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:47:05 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x438   Process Name:  C:\Windows\System32\VSSVC.exe  "
5091,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:47:05 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x438   Process Name:  C:\Windows\System32\VSSVC.exe  "
5090,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:47:05 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x438   Process Name:  C:\Windows\System32\VSSVC.exe  "
5089,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:47:05 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5088,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:47:05 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5087,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:47:02 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x3d0   Process Name:  C:\Windows\System32\LogonUI.exe  "
5086,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:46:55 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5085,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:46:55 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5084,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:46:52 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5083,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:46:52 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5082,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:46:39 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x19ee6    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xcf4   Process Name:  C:\Program Files\OpenSSH\bin\cygrunsrv.exe  "
5081,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:46:28 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x48c   Process Name:  C:\Windows\System32\svchost.exe  "
5080,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:46:24 AM,5024,None,"The Windows Firewall service started successfully.  "
5079,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:46:23 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5078,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:46:23 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5077,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:46:18 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x970   Process Name:  C:\Windows\System32\svchost.exe  "
5076,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:46:18 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x970   Process Name:  C:\Windows\System32\svchost.exe  "
5075,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:46:15 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5074,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:46:15 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5073,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:46:10 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5072,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:46:10 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5071,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:46:08 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x91c   Process Name:  C:\Windows\System32\svchost.exe  "
5070,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:46:08 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x91c   Process Name:  C:\Windows\System32\svchost.exe  "
5069,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:46:06 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5068,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:46:06 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5067,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:46:03 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5066,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:46:03 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5065,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:46:02 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x19ee6    Privileges:  SeCreateTokenPrivilege     SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5064,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:46:02 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x19ee6   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5063,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:46:02 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
5062,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:58 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5061,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:58 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5060,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:58 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5059,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:58 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5058,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:58 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5057,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:58 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5056,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:58 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5055,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:58 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5054,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:58 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5053,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:58 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5052,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:58 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5051,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:58 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5050,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:55 AM,5033,None,"The Windows Firewall Driver started successfully.  "
5049,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:54 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5048,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:54 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5047,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:53 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5046,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:53 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5045,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:46 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5044,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:46 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5043,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:46 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5042,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:46 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5041,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:36 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5040,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:36 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5039,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:35 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5038,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:35 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5037,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:34 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5036,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:34 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5035,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:33 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
5034,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:33 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5033,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:33 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5032,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:33 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5031,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:33 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5030,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:33 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5029,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:31 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xc8bc    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege  "
5028,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:31 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xc8a5    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
5027,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:31 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xc8bc   Linked Logon ID:  0xc8a5   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x208   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5026,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:31 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xc8a5   Linked Logon ID:  0xc8bc   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x208   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5025,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:31 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  DWM-1   Account Domain:  Window Manager   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x208   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
5024,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:30 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5023,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:30 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5022,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:29 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
5021,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:29 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5020,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:27 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5019,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5018,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:27 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
5017,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x268   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5016,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-1   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon ID:  0x7ce4   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x208   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5015,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:27 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x208   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
5014,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-0   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon ID:  0x7cf6   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1dc   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5013,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:27 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1dc   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
5012,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:26 AM,4902,None,"The Per-user audit policy table was created.    Number of Elements: 0  Policy ID: 0x7b3e  "
5011,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:25 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Logon Information:   Logon Type:  0   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  -    New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4   Process Name:  ?    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  -   Authentication Package: -   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
5010,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:25 AM,4608,None,"Windows is starting up.    This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.  "
5009,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:24 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x278   New Process Name: ??????????????e??? ????????? ???????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1dc   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
5008,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:23 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x268   New Process Name: ????????????????-??6??c????0--?0???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1dc   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
5007,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:22 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x208   New Process Name: ????????????????-??6??0????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1c0   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
5006,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:21 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1dc   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x16c   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
5005,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:21 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1c8   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1c0   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
5004,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:21 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1c0   New Process Name: ??????????????-??6??0????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x120   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
5003,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:20 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x178   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x16c   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
5002,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:19 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x16c   New Process Name: ??????????????-??6??0????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x120   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
5001,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:14 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x134   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x120   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
5000,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:08 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x120   New Process Name: ??????????????-??6?4????0--?0???????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x4   Creator Process Name: ???????   Process Command Line: ????0--?0???????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4999,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 6:45:07 AM,4826,None,"Boot Configuration Data loaded.    Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    General Settings:   Load Options:  -   Advanced Options:  No     Configuration Access Policy: Default     System Event Logging: No     Kernel Debugging: No     VSM Launch Type: Off      Signature Settings:   Test Signing:  No     Flight Signing:  No     Disable Integrity Checks: No      HyperVisor Settings:   HyperVisor Load Options: -   HyperVisor Launch Type: Off     HyperVisor Debugging: No    "
4998,Security,Microsoft-Windows-Eventlog,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:17 AM,1100,None,"The event logging service has shut down.  "
4997,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:15 AM,4647,None,"User initiated logoff:    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x123b8    This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.  "
4996,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:15 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x11b8   Process Name:  C:\Windows\System32\VSSVC.exe  "
4995,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:15 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x11b8   Process Name:  C:\Windows\System32\VSSVC.exe  "
4994,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:15 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x11b8   Process Name:  C:\Windows\System32\VSSVC.exe  "
4993,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:15 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x11b8   Process Name:  C:\Windows\System32\VSSVC.exe  "
4992,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:15 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x11b8   Process Name:  C:\Windows\System32\VSSVC.exe  "
4991,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:15 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x11b8   Process Name:  C:\Windows\System32\VSSVC.exe  "
4990,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:15 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x11b8   Process Name:  C:\Windows\System32\VSSVC.exe  "
4989,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:15 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x11b8   Process Name:  C:\Windows\System32\VSSVC.exe  "
4988,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:15 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4987,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:15 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4986,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:12 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4985,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:12 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4984,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:12 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x3c0   Process Name:  C:\Windows\System32\LogonUI.exe  "
4983,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:10 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4982,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:10 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4981,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:10 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4980,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:10 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4979,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:09 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4978,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:09 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4977,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:09 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4976,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:09 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4975,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:08 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x90c   Process Name:  C:\Windows\System32\svchost.exe  "
4974,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:08 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x90c   Process Name:  C:\Windows\System32\svchost.exe  "
4973,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:08 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x17df0    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xc14   Process Name:  C:\Program Files\OpenSSH\bin\cygrunsrv.exe  "
4972,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:07 AM,5024,None,"The Windows Firewall service started successfully.  "
4971,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:07 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4970,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:07 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4969,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:07 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x8e4   Process Name:  C:\Windows\System32\svchost.exe  "
4968,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:07 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x8e4   Process Name:  C:\Windows\System32\svchost.exe  "
4967,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:06 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x44c   Process Name:  C:\Windows\System32\svchost.exe  "
4966,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:06 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4965,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:06 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4964,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:06 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x44c   Process Name:  C:\Windows\System32\svchost.exe  "
4963,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:06 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4962,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:06 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4961,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:06 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4960,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:06 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4959,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:06 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4958,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:06 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4957,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:06 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4956,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:06 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4955,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:06 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x17df0    Privileges:  SeCreateTokenPrivilege     SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4954,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:06 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x17df0   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4953,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:06 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4952,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:06 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4951,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:06 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4950,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:06 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4949,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:06 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4948,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:06 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4947,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:06 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4946,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:05 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4945,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:05 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4944,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:05 AM,5033,None,"The Windows Firewall Driver started successfully.  "
4943,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:05 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4942,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:05 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4941,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:05 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4940,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:05 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4939,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:05 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4938,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:05 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4937,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:05 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1235c    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4936,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:05 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x123b8   Linked Logon ID:  0x1235c   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4c8   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4935,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:05 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1235c   Linked Logon ID:  0x123b8   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4c8   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4934,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:05 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x4c8   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4933,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:05 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4932,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:05 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4931,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:05 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4930,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:05 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4929,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:04 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4928,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:04 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4927,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:04 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4926,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:04 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4925,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:04 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4924,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:04 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4923,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:04 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4922,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:04 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4921,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:04 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
4920,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:04 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4919,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:04 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xc7f6    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege  "
4918,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:04 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xc7c0    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
4917,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:04 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xc7f6   Linked Logon ID:  0xc7c0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x224   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4916,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:04 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xc7c0   Linked Logon ID:  0xc7f6   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x224   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4915,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:04 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  DWM-1   Account Domain:  Window Manager   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x224   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4914,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:03 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4913,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:03 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4912,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:03 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
4911,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:03 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4910,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:03 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4909,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:03 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4908,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:03 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4907,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:03 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x22c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4906,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:03 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-0   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon ID:  0x79e1   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1c4   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4905,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:03 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1c4   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4904,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:03 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-1   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon ID:  0x79ef   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x224   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4903,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:03 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x224   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4902,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:03 AM,4902,None,"The Per-user audit policy table was created.    Number of Elements: 0  Policy ID: 0x7837  "
4901,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:03 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Logon Information:   Logon Type:  0   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  -    New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4   Process Name:  ?    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  -   Authentication Package: -   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4900,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:03 AM,4608,None,"Windows is starting up.    This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.  "
4899,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:03 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x254   New Process Name: ??????????????e??? ????????? ???????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1c4   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4898,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:03 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x22c   New Process Name: ????????????????-??6??4????0--?0???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1c4   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4897,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:03 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x224   New Process Name: ????????????????-??6??c????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1bc   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4896,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:03 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1d4   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1bc   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4895,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:03 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1c4   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x16c   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4894,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:03 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1bc   New Process Name: ??????????????-??6??c????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x11c   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4893,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:02 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x174   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x16c   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4892,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:02 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x16c   New Process Name: ??????????????-??6??c????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x11c   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4891,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:01 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x130   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x11c   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4890,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:00 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x11c   New Process Name: ??????????????-??6?4????0--?0???????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x4   Creator Process Name: ???????   Process Command Line: ????0--?0???????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4889,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:58:00 AM,4826,None,"Boot Configuration Data loaded.    Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    General Settings:   Load Options:  -   Advanced Options:  No     Configuration Access Policy: Default     System Event Logging: No     Kernel Debugging: No     VSM Launch Type: Off      Signature Settings:   Test Signing:  No     Flight Signing:  No     Disable Integrity Checks: No      HyperVisor Settings:   HyperVisor Load Options: -   HyperVisor Launch Type: Off     HyperVisor Debugging: No    "
4888,Security,Microsoft-Windows-Eventlog,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:57:03 AM,1100,None,"The event logging service has shut down.  "
4887,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:57:02 AM,4647,None,"User initiated logoff:    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x133fc    This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.  "
4886,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:57:02 AM,5059,None,"Key migration operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Additional Information:   Operation: Export of persistent cryptographic key.     Return Code: 0x0  "
4885,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:57:02 AM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
4884,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:57:02 AM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Key File Operation Information:   File Path: C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
4883,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:57:01 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x17cc   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
4882,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:57:01 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x17cc   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
4881,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:57:00 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4880,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:57:00 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4879,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:57 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4878,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:57 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4877,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:56 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xf40   Process Name:  C:\Windows\System32\VSSVC.exe  "
4876,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:56 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xf40   Process Name:  C:\Windows\System32\VSSVC.exe  "
4875,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:56 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xf40   Process Name:  C:\Windows\System32\VSSVC.exe  "
4874,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:56 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xf40   Process Name:  C:\Windows\System32\VSSVC.exe  "
4873,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:56 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xf40   Process Name:  C:\Windows\System32\VSSVC.exe  "
4872,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:56 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xf40   Process Name:  C:\Windows\System32\VSSVC.exe  "
4871,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:56 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xf40   Process Name:  C:\Windows\System32\VSSVC.exe  "
4870,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:56 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xf40   Process Name:  C:\Windows\System32\VSSVC.exe  "
4869,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:55 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4868,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:55 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4867,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:53 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x3c8   Process Name:  C:\Windows\System32\LogonUI.exe  "
4866,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:51 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4865,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:51 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4864,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:51 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4863,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:51 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4862,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:50 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x1724b    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xee4   Process Name:  C:\Program Files\OpenSSH\bin\cygrunsrv.exe  "
4861,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x4a0   Process Name:  C:\Windows\System32\svchost.exe  "
4860,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x4a0   Process Name:  C:\Windows\System32\svchost.exe  "
4859,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4858,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4857,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4856,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4855,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4854,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4853,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x8f8   Process Name:  C:\Windows\System32\svchost.exe  "
4852,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x8f8   Process Name:  C:\Windows\System32\svchost.exe  "
4851,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:48 AM,5024,None,"The Windows Firewall service started successfully.  "
4850,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:47 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x8f0   Process Name:  C:\Windows\System32\svchost.exe  "
4849,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:47 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x8f0   Process Name:  C:\Windows\System32\svchost.exe  "
4848,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4847,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4846,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:46 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4845,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:46 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4844,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:46 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4843,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:46 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4842,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:46 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4841,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:46 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4840,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:46 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4839,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:46 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4838,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:46 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x1724b    Privileges:  SeCreateTokenPrivilege     SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4837,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:46 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x1724b   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4836,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:46 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4835,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:46 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4834,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:46 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4833,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:46 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4832,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:46 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4831,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:46 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4830,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:46 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4829,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:45 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4828,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:45 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4827,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:45 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4826,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:45 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4825,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:45 AM,5033,None,"The Windows Firewall Driver started successfully.  "
4824,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:45 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4823,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:45 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4822,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:45 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4821,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:45 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4820,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:45 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x133a2    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4819,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:45 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x133fc   Linked Logon ID:  0x133a2   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x518   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4818,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:45 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x133a2   Linked Logon ID:  0x133fc   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x518   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4817,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:45 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x518   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4816,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:44 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4815,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:44 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4814,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:44 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4813,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:44 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4812,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:44 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4811,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:44 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4810,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:44 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4809,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:44 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4808,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
4807,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4806,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4805,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4804,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4803,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4802,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4801,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4800,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xd038    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege  "
4799,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xd020    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
4798,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xd038   Linked Logon ID:  0xd020   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x228   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4797,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xd020   Linked Logon ID:  0xd038   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x228   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4796,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  DWM-1   Account Domain:  Window Manager   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x228   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4795,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4794,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4793,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
4792,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4791,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4790,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4789,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4788,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x23c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4787,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-1   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon ID:  0x8342   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x228   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4786,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x228   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4785,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-0   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon ID:  0x8334   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1c4   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4784,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1c4   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4783,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4902,None,"The Per-user audit policy table was created.    Number of Elements: 0  Policy ID: 0x8199  "
4782,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Logon Information:   Logon Type:  0   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  -    New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4   Process Name:  ?    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  -   Authentication Package: -   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4781,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4608,None,"Windows is starting up.    This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.  "
4780,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:43 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x258   New Process Name: ??????????????e??? ????????? ???????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1c4   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4779,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:42 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x23c   New Process Name: ????????????????-??6??4????0--?0???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1c4   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4778,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:42 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x228   New Process Name: ????????????????-??6??c????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1bc   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4777,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:42 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1cc   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1bc   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4776,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:42 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1c4   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x164   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4775,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:42 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1bc   New Process Name: ??????????????-??6??c????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x11c   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4774,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:42 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x170   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x164   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4773,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:42 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x164   New Process Name: ??????????????-??6??c????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x11c   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4772,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:40 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x130   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x11c   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4771,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:40 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x11c   New Process Name: ??????????????-??6?4????0--?0???????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x4   Creator Process Name: ???????   Process Command Line: ????0--?0???????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4770,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:40 AM,4826,None,"Boot Configuration Data loaded.    Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    General Settings:   Load Options:  -   Advanced Options:  No     Configuration Access Policy: Default     System Event Logging: No     Kernel Debugging: No     VSM Launch Type: Off      Signature Settings:   Test Signing:  No     Flight Signing:  No     Disable Integrity Checks: No      HyperVisor Settings:   HyperVisor Load Options: -   HyperVisor Launch Type: Off     HyperVisor Debugging: No    "
4769,Security,Microsoft-Windows-Eventlog,SUCCESS AUDIT,MSEDGEWIN10,12/21/2017 5:56:44 AM,1101,None,"Audit events have been dropped by the transport.  0  "
4768,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 7:01:12 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4767,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 7:01:12 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4766,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 7:01:12 AM,4647,None,"User initiated logoff:    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x130aa    This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.  "
4765,Security,Microsoft-Windows-Eventlog,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 7:01:12 AM,1100,None,"The event logging service has shut down.  "
4764,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 7:00:06 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4763,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 7:00:06 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4762,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 7:00:03 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4761,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 7:00:03 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4760,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:51 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4759,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:51 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4758,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:41 AM,5059,None,"Key migration operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Additional Information:   Operation: Export of persistent cryptographic key.     Return Code: 0x0  "
4757,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:41 AM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
4756,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:41 AM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Key File Operation Information:   File Path: C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
4755,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4754,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4753,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:40 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4752,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:40 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4751,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:35 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x1740   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
4750,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:35 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x1740   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
4749,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:35 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x1204   Process Name:  C:\Windows\System32\VSSVC.exe  "
4748,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:35 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x1204   Process Name:  C:\Windows\System32\VSSVC.exe  "
4747,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:35 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x1204   Process Name:  C:\Windows\System32\VSSVC.exe  "
4746,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:35 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x1204   Process Name:  C:\Windows\System32\VSSVC.exe  "
4745,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:35 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4744,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:35 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4743,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:34 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x1204   Process Name:  C:\Windows\System32\VSSVC.exe  "
4742,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:34 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x1204   Process Name:  C:\Windows\System32\VSSVC.exe  "
4741,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:34 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x1204   Process Name:  C:\Windows\System32\VSSVC.exe  "
4740,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:34 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x1204   Process Name:  C:\Windows\System32\VSSVC.exe  "
4739,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:33 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4738,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:33 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4737,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:33 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4736,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:33 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4735,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:33 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4734,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:33 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4733,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:32 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4732,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:32 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4731,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:31 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x3a8   Process Name:  C:\Windows\System32\LogonUI.exe  "
4730,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:31 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4729,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:31 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4728,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:31 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4727,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:31 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4726,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:30 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4725,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:30 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4724,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:30 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4723,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:30 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4722,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:30 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4721,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:30 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4720,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:30 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x8c0   Process Name:  C:\Windows\System32\svchost.exe  "
4719,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:30 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x8c0   Process Name:  C:\Windows\System32\svchost.exe  "
4718,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:29 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x154af    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x56c   Process Name:  C:\Program Files\OpenSSH\bin\cygrunsrv.exe  "
4717,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:29 AM,5024,None,"The Windows Firewall service started successfully.  "
4716,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:29 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4715,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:29 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4714,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:29 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x414   Process Name:  C:\Windows\System32\svchost.exe  "
4713,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:29 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x414   Process Name:  C:\Windows\System32\svchost.exe  "
4712,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x898   Process Name:  C:\Windows\System32\svchost.exe  "
4711,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x898   Process Name:  C:\Windows\System32\svchost.exe  "
4710,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4709,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4708,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4707,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4706,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4705,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4704,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4703,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4702,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x154af    Privileges:  SeCreateTokenPrivilege     SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4701,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x154af   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4700,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4699,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4698,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4697,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4696,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4695,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4694,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4693,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4692,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4691,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4690,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4689,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x12f96    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4688,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x130aa   Linked Logon ID:  0x12f96   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x48c   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4687,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x12f96   Linked Logon ID:  0x130aa   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x48c   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4686,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x48c   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4685,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,5033,None,"The Windows Firewall Driver started successfully.  "
4684,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4683,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4682,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4681,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:28 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4680,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:27 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4679,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4678,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:27 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4677,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4676,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:27 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4675,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4674,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:27 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4673,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4672,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:27 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4671,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4670,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:27 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
4669,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4668,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:27 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4667,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4666,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:27 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbaeb    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege  "
4665,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:27 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbac0    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
4664,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbaeb   Linked Logon ID:  0xbac0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x200   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4663,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbac0   Linked Logon ID:  0xbaeb   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x200   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4662,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:27 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  DWM-1   Account Domain:  Window Manager   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x200   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4661,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:27 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4660,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4659,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:27 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
4658,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4657,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:26 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4656,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:26 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4655,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:26 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4654,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:26 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x244   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4653,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:26 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-0   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon ID:  0x7311   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1bc   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4652,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:26 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1bc   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4651,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:26 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-1   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon ID:  0x731d   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x200   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4650,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:26 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x200   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4649,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:26 AM,4902,None,"The Per-user audit policy table was created.    Number of Elements: 0  Policy ID: 0x716d  "
4648,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:26 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Logon Information:   Logon Type:  0   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  -    New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4   Process Name:  ?    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  -   Authentication Package: -   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4647,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:26 AM,4608,None,"Windows is starting up.    This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.  "
4646,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:26 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x24c   New Process Name: ??????????????e??? ????????? ???????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1bc   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4645,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:26 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x244   New Process Name: ????????????????-??6??c????0--?0???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1bc   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4644,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:26 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x200   New Process Name: ????????????????-??6??4????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1b4   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4643,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:26 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1c4   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1b4   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4642,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:26 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1bc   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x164   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4641,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:26 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1b4   New Process Name: ??????????????-??6??8????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x118   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4640,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:26 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x16c   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x164   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4639,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:26 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x164   New Process Name: ??????????????-??6??8????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x118   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4638,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:25 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x12c   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x118   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4637,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:25 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x118   New Process Name: ??????????????-??6?4????0--?0???????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x4   Creator Process Name: ???????   Process Command Line: ????0--?0???????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4636,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:25 AM,4826,None,"Boot Configuration Data loaded.    Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    General Settings:   Load Options:  -   Advanced Options:  No     Configuration Access Policy: Default     System Event Logging: No     Kernel Debugging: No     VSM Launch Type: Off      Signature Settings:   Test Signing:  No     Flight Signing:  No     Disable Integrity Checks: No      HyperVisor Settings:   HyperVisor Load Options: -   HyperVisor Launch Type: Off     HyperVisor Debugging: No    "
4635,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:10 AM,4647,None,"User initiated logoff:    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x12d9d    This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.  "
4634,Security,Microsoft-Windows-Eventlog,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:11 AM,1100,None,"The event logging service has shut down.  "
4633,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:04 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4632,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:59:04 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4631,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:59 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4630,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:59 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4629,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:56 AM,5059,None,"Key migration operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Additional Information:   Operation: Export of persistent cryptographic key.     Return Code: 0x0  "
4628,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:56 AM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
4627,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:56 AM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Key File Operation Information:   File Path: C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
4626,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:55 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4625,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:55 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4624,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:52 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x171c   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
4623,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:52 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x171c   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
4622,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:52 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4621,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:52 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4620,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4619,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4618,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4617,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4616,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x12c0   Process Name:  C:\Windows\System32\VSSVC.exe  "
4615,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x12c0   Process Name:  C:\Windows\System32\VSSVC.exe  "
4614,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x12c0   Process Name:  C:\Windows\System32\VSSVC.exe  "
4613,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x12c0   Process Name:  C:\Windows\System32\VSSVC.exe  "
4612,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x12c0   Process Name:  C:\Windows\System32\VSSVC.exe  "
4611,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x12c0   Process Name:  C:\Windows\System32\VSSVC.exe  "
4610,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x12c0   Process Name:  C:\Windows\System32\VSSVC.exe  "
4609,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x12c0   Process Name:  C:\Windows\System32\VSSVC.exe  "
4608,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:48 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4607,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:48 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4606,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:47 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x3cc   Process Name:  C:\Windows\System32\LogonUI.exe  "
4605,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:46 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4604,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:46 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4603,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:46 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4602,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:46 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4601,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:45 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4600,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:45 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4599,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:45 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4598,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:45 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4597,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:45 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4596,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:45 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4595,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:44 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x14db2    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xd18   Process Name:  C:\Program Files\OpenSSH\bin\cygrunsrv.exe  "
4594,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:44 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x8bc   Process Name:  C:\Windows\System32\svchost.exe  "
4593,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:44 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x8bc   Process Name:  C:\Windows\System32\svchost.exe  "
4592,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:44 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4591,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:44 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4590,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:43 AM,5024,None,"The Windows Firewall service started successfully.  "
4589,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:43 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x448   Process Name:  C:\Windows\System32\svchost.exe  "
4588,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:43 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x448   Process Name:  C:\Windows\System32\svchost.exe  "
4587,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:43 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x894   Process Name:  C:\Windows\System32\svchost.exe  "
4586,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:43 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x894   Process Name:  C:\Windows\System32\svchost.exe  "
4585,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4584,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4583,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4582,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4581,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4580,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4579,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4578,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4577,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4576,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4575,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x14db2    Privileges:  SeCreateTokenPrivilege     SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4574,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x14db2   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4573,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4572,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4571,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4570,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4569,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4568,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4567,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4566,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4565,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4564,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4563,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4562,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x12cf3    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4561,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x12d9d   Linked Logon ID:  0x12cf3   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4a8   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4560,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x12cf3   Linked Logon ID:  0x12d9d   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4a8   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4559,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x4a8   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4558,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,5033,None,"The Windows Firewall Driver started successfully.  "
4557,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4556,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:42 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4555,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4554,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4553,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4552,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4551,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4550,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4549,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4548,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4547,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4546,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4545,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4544,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4543,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4542,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4541,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
4540,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4539,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbb6d    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege  "
4538,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbb0c    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
4537,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbb6d   Linked Logon ID:  0xbb0c   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x20c   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4536,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbb0c   Linked Logon ID:  0xbb6d   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x20c   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4535,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:41 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  DWM-1   Account Domain:  Window Manager   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x20c   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4534,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4533,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4532,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:40 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
4531,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:40 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4530,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:40 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4529,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:40 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4528,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:40 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4527,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:40 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4526,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:40 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-0   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon ID:  0x72e2   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1c8   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4525,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:40 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1c8   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4524,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:40 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-1   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon ID:  0x7303   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x20c   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4523,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:40 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x20c   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4522,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:40 AM,4902,None,"The Per-user audit policy table was created.    Number of Elements: 0  Policy ID: 0x7149  "
4521,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:40 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Logon Information:   Logon Type:  0   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  -    New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4   Process Name:  ?    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  -   Authentication Package: -   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4520,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:40 AM,4608,None,"Windows is starting up.    This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.  "
4519,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:40 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x258   New Process Name: ??????????????e??? ????????? ???????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1c8   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4518,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:40 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x250   New Process Name: ????????????????-??6??8????0--?0???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1c8   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4517,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:40 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x20c   New Process Name: ????????????????-??6??c????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1bc   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4516,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:40 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1d0   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1bc   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4515,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:40 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1c8   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x16c   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4514,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:40 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1bc   New Process Name: ??????????????-??6??0????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x120   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4513,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:40 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x174   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x16c   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4512,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:40 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x16c   New Process Name: ??????????????-??6??0????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x120   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4511,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:39 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x134   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x120   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4510,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:39 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x120   New Process Name: ??????????????-??6?4????0--?0???????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x4   Creator Process Name: ???????   Process Command Line: ????0--?0???????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4509,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:39 AM,4826,None,"Boot Configuration Data loaded.    Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    General Settings:   Load Options:  -   Advanced Options:  No     Configuration Access Policy: Default     System Event Logging: No     Kernel Debugging: No     VSM Launch Type: Off      Signature Settings:   Test Signing:  No     Flight Signing:  No     Disable Integrity Checks: No      HyperVisor Settings:   HyperVisor Load Options: -   HyperVisor Launch Type: Off     HyperVisor Debugging: No    "
4508,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:24 AM,4647,None,"User initiated logoff:    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x130da    This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.  "
4507,Security,Microsoft-Windows-Eventlog,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:24 AM,1100,None,"The event logging service has shut down.  "
4506,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:21 AM,5059,None,"Key migration operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Additional Information:   Operation: Export of persistent cryptographic key.     Return Code: 0x0  "
4505,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:21 AM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
4504,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:21 AM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Key File Operation Information:   File Path: C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
4503,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:16 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x17e8   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
4502,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:16 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x17e8   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
4501,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:15 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4500,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:15 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4499,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:15 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x1414   Process Name:  C:\Windows\System32\VSSVC.exe  "
4498,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:15 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x1414   Process Name:  C:\Windows\System32\VSSVC.exe  "
4497,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:14 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x1414   Process Name:  C:\Windows\System32\VSSVC.exe  "
4496,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:14 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x1414   Process Name:  C:\Windows\System32\VSSVC.exe  "
4495,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:14 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x1414   Process Name:  C:\Windows\System32\VSSVC.exe  "
4494,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:14 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x1414   Process Name:  C:\Windows\System32\VSSVC.exe  "
4493,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:14 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x1414   Process Name:  C:\Windows\System32\VSSVC.exe  "
4492,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:14 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x1414   Process Name:  C:\Windows\System32\VSSVC.exe  "
4491,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:14 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4490,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:14 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4489,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:13 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4488,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:13 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4487,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:13 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4486,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:13 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4485,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:12 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x3a4   Process Name:  C:\Windows\System32\LogonUI.exe  "
4484,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:12 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4483,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:12 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4482,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:11 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4481,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:11 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4480,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:11 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4479,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:11 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4478,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:11 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4477,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:11 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4476,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:10 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4475,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:10 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4474,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:10 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x15243    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xd5c   Process Name:  C:\Program Files\OpenSSH\bin\cygrunsrv.exe  "
4473,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:10 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x8b8   Process Name:  C:\Windows\System32\svchost.exe  "
4472,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:10 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x8b8   Process Name:  C:\Windows\System32\svchost.exe  "
4471,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:10 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4470,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:10 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4469,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:10 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x448   Process Name:  C:\Windows\System32\svchost.exe  "
4468,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:10 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x448   Process Name:  C:\Windows\System32\svchost.exe  "
4467,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:09 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x8a4   Process Name:  C:\Windows\System32\svchost.exe  "
4466,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:09 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x8a4   Process Name:  C:\Windows\System32\svchost.exe  "
4465,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:09 AM,5024,None,"The Windows Firewall service started successfully.  "
4464,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:09 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4463,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:09 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4462,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4461,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4460,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4459,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4458,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4457,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4456,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4455,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4454,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4453,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4452,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x15243    Privileges:  SeCreateTokenPrivilege     SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4451,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x15243   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4450,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4449,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4448,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4447,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4446,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4445,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4444,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4443,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4442,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4441,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x13017    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4440,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x130da   Linked Logon ID:  0x13017   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4b4   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4439,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x13017   Linked Logon ID:  0x130da   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4b4   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4438,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x4b4   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4437,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,5033,None,"The Windows Firewall Driver started successfully.  "
4436,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4435,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4434,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4433,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:08 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4432,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:07 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4431,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:07 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4430,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:07 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4429,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:07 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4428,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:07 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4427,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:07 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4426,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:07 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4425,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:07 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4424,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:07 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4423,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:07 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4422,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:07 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4421,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:07 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4420,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:07 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
4419,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:07 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4418,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:07 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbad4    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege  "
4417,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:07 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbab4    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
4416,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:07 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbad4   Linked Logon ID:  0xbab4   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1fc   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4415,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:07 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbab4   Linked Logon ID:  0xbad4   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1fc   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4414,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:07 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  DWM-1   Account Domain:  Window Manager   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1fc   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4413,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:07 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4412,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:07 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4411,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:07 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
4410,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:07 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4409,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:06 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4408,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:06 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4407,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:06 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4406,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:06 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x240   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4405,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:06 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-0   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon ID:  0x72c4   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1bc   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4404,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:06 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1bc   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4403,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:06 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-1   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon ID:  0x72d3   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1fc   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4402,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:06 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1fc   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4401,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:06 AM,4902,None,"The Per-user audit policy table was created.    Number of Elements: 0  Policy ID: 0x7119  "
4400,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:06 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Logon Information:   Logon Type:  0   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  -    New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4   Process Name:  ?    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  -   Authentication Package: -   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4399,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:06 AM,4608,None,"Windows is starting up.    This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.  "
4398,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:06 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x248   New Process Name: ??????????????e??? ????????? ???????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1bc   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4397,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:06 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x240   New Process Name: ????????????????-??6??c????0--?0???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1bc   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4396,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:06 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1fc   New Process Name: ????????????????-??6??4????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1b4   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4395,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:06 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1c4   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1b4   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4394,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:06 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1bc   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x164   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4393,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:06 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1b4   New Process Name: ??????????????-??6??8????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x118   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4392,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:06 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x16c   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x164   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4391,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:06 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x164   New Process Name: ??????????????-??6??8????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x118   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4390,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:05 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x12c   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x118   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4389,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:05 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x118   New Process Name: ??????????????-??6?4????0--?0???????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x4   Creator Process Name: ???????   Process Command Line: ????0--?0???????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4388,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:58:05 AM,4826,None,"Boot Configuration Data loaded.    Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    General Settings:   Load Options:  -   Advanced Options:  No     Configuration Access Policy: Default     System Event Logging: No     Kernel Debugging: No     VSM Launch Type: Off      Signature Settings:   Test Signing:  No     Flight Signing:  No     Disable Integrity Checks: No      HyperVisor Settings:   HyperVisor Load Options: -   HyperVisor Launch Type: Off     HyperVisor Debugging: No    "
4387,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:45 AM,4647,None,"User initiated logoff:    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x50a66    This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.  "
4386,Security,Microsoft-Windows-Eventlog,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:45 AM,1100,None,"The event logging service has shut down.  "
4385,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:43 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4384,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:43 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4383,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:34 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x19c0   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
4382,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:34 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x19c0   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
4381,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:34 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4380,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:34 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4379,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:34 AM,5059,None,"Key migration operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Additional Information:   Operation: Export of persistent cryptographic key.     Return Code: 0x0  "
4378,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:34 AM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
4377,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:34 AM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Key File Operation Information:   File Path: C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
4376,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:29 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4375,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:29 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4374,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:29 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4373,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:29 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4372,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:28 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4371,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:28 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4370,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:28 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4369,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:28 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4368,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:28 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4367,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:28 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4366,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:24 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x3b0   Process Name:  C:\Windows\System32\LogonUI.exe  "
4365,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:23 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4364,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:23 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4363,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:22 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x444   Process Name:  C:\Windows\System32\svchost.exe  "
4362,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:22 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x50a49    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4361,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:22 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x50a66   Linked Logon ID:  0x50a49   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x720   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4360,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:22 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x50a49   Linked Logon ID:  0x50a66   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x720   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4359,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:22 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x720   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4358,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:19 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4357,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:19 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4356,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4355,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4354,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\bootmgr   Handle ID: 0x2fc    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4353,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\zh-TW\memtest.exe.mui   Handle ID: 0x360    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4352,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\zh-TW\bootmgr.exe.mui   Handle ID: 0x360    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4351,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\zh-CN\memtest.exe.mui   Handle ID: 0x360    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4350,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\zh-CN\bootmgr.exe.mui   Handle ID: 0x360    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4349,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\uk-UA\bootmgr.exe.mui   Handle ID: 0x360    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4348,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\tr-TR\memtest.exe.mui   Handle ID: 0x360    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4347,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\tr-TR\bootmgr.exe.mui   Handle ID: 0x360    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4346,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\sv-SE\memtest.exe.mui   Handle ID: 0x360    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4345,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\sv-SE\bootmgr.exe.mui   Handle ID: 0x360    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4344,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\sr-Latn-RS\bootmgr.exe.mui   Handle ID: 0x360    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4343,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\sl-SI\bootmgr.exe.mui   Handle ID: 0x360    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4342,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\sk-SK\bootmgr.exe.mui   Handle ID: 0x360    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4341,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\ru-RU\memtest.exe.mui   Handle ID: 0x328    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4340,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\ru-RU\bootmgr.exe.mui   Handle ID: 0x328    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4339,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\ro-RO\bootmgr.exe.mui   Handle ID: 0x328    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4338,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\qps-ploc\memtest.exe.mui   Handle ID: 0x328    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4337,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\qps-ploc\bootmgr.exe.mui   Handle ID: 0x328    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4336,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\pt-PT\memtest.exe.mui   Handle ID: 0x328    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4335,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\pt-PT\bootmgr.exe.mui   Handle ID: 0x328    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4334,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\pt-BR\memtest.exe.mui   Handle ID: 0x328    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4333,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\pt-BR\bootmgr.exe.mui   Handle ID: 0x328    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4332,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\pl-PL\memtest.exe.mui   Handle ID: 0x308    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4331,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\pl-PL\bootmgr.exe.mui   Handle ID: 0x308    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4330,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\nl-NL\memtest.exe.mui   Handle ID: 0x308    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4329,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\nl-NL\bootmgr.exe.mui   Handle ID: 0x308    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4328,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\nb-NO\memtest.exe.mui   Handle ID: 0x308    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4327,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\nb-NO\bootmgr.exe.mui   Handle ID: 0x308    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4326,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\memtest.exe   Handle ID: 0x338    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4325,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\lv-LV\bootmgr.exe.mui   Handle ID: 0x394    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4324,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\lt-LT\bootmgr.exe.mui   Handle ID: 0x394    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4323,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\ko-KR\memtest.exe.mui   Handle ID: 0x394    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4322,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\ko-KR\bootmgr.exe.mui   Handle ID: 0x394    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4321,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\ja-JP\memtest.exe.mui   Handle ID: 0x394    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4320,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\ja-JP\bootmgr.exe.mui   Handle ID: 0x394    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4319,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\it-IT\memtest.exe.mui   Handle ID: 0x394    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4318,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\it-IT\bootmgr.exe.mui   Handle ID: 0x394    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4317,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\hu-HU\memtest.exe.mui   Handle ID: 0x3cc    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4316,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\hu-HU\bootmgr.exe.mui   Handle ID: 0x3cc    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4315,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\hr-HR\bootmgr.exe.mui   Handle ID: 0x3cc    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4314,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\fr-FR\memtest.exe.mui   Handle ID: 0x3cc    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4313,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\fr-FR\bootmgr.exe.mui   Handle ID: 0x3cc    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4312,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\fr-CA\bootmgr.exe.mui   Handle ID: 0x3cc    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4311,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\fi-FI\memtest.exe.mui   Handle ID: 0x3cc    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4310,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\fi-FI\bootmgr.exe.mui   Handle ID: 0x3cc    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4309,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\et-EE\bootmgr.exe.mui   Handle ID: 0x3cc    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4308,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\es-MX\bootmgr.exe.mui   Handle ID: 0x3cc    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4307,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\es-ES\memtest.exe.mui   Handle ID: 0x3cc    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4306,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\es-ES\bootmgr.exe.mui   Handle ID: 0x3cc    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4305,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\en-US\memtest.exe.mui   Handle ID: 0x3cc    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4304,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\en-US\bootmgr.exe.mui   Handle ID: 0x320    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4303,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\en-GB\bootmgr.exe.mui   Handle ID: 0x320    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4302,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\el-GR\memtest.exe.mui   Handle ID: 0x320    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4301,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\el-GR\bootmgr.exe.mui   Handle ID: 0x320    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4300,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\de-DE\memtest.exe.mui   Handle ID: 0x320    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4299,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\de-DE\bootmgr.exe.mui   Handle ID: 0x320    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4298,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\da-DK\memtest.exe.mui   Handle ID: 0x320    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4297,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\da-DK\bootmgr.exe.mui   Handle ID: 0x320    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4296,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\cs-CZ\memtest.exe.mui   Handle ID: 0x320    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4295,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\cs-CZ\bootmgr.exe.mui   Handle ID: 0x320    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4294,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\bootvhd.dll   Handle ID: 0x328    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4293,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\bootnxt   Handle ID: 0x328    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4292,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\bootmgr   Handle ID: 0x328    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4291,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:17 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\bg-BG\bootmgr.exe.mui   Handle ID: 0x320    Process Information:   Process ID: 0x548   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.96_none_2c40cc7f3876f2b7\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4290,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:13 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xf38   Process Name:  C:\Windows\System32\VSSVC.exe  "
4289,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:13 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xf38   Process Name:  C:\Windows\System32\VSSVC.exe  "
4288,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:13 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xf38   Process Name:  C:\Windows\System32\VSSVC.exe  "
4287,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:13 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xf38   Process Name:  C:\Windows\System32\VSSVC.exe  "
4286,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:13 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xf38   Process Name:  C:\Windows\System32\VSSVC.exe  "
4285,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:13 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xf38   Process Name:  C:\Windows\System32\VSSVC.exe  "
4284,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:13 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xf38   Process Name:  C:\Windows\System32\VSSVC.exe  "
4283,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:13 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xf38   Process Name:  C:\Windows\System32\VSSVC.exe  "
4282,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:12 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4281,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:12 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4280,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:10 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x1555b    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xe54   Process Name:  C:\Program Files\OpenSSH\bin\cygrunsrv.exe  "
4279,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:10 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x444   Process Name:  C:\Windows\System32\svchost.exe  "
4278,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:10 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4277,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:10 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4276,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:10 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4275,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:10 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4274,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:10 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4273,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:10 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4272,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:09 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x8d0   Process Name:  C:\Windows\System32\svchost.exe  "
4271,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:09 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x8d0   Process Name:  C:\Windows\System32\svchost.exe  "
4270,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:08 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4269,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:08 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4268,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:08 AM,5024,None,"The Windows Firewall service started successfully.  "
4267,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:08 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x8c8   Process Name:  C:\Windows\System32\svchost.exe  "
4266,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:08 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x8c8   Process Name:  C:\Windows\System32\svchost.exe  "
4265,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:07 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4264,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:07 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4263,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:07 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4262,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:07 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4261,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:07 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4260,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:07 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4259,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:07 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4258,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:07 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4257,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:07 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4256,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:07 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4255,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:07 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4254,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:07 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4253,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:07 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x1555b    Privileges:  SeCreateTokenPrivilege     SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4252,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:07 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x1555b   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4251,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:07 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4250,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:07 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4249,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:07 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4248,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:07 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4247,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:07 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4246,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:06 AM,5033,None,"The Windows Firewall Driver started successfully.  "
4245,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:06 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4244,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:06 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4243,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:06 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4242,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:06 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4241,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:04 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4240,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:04 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4239,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:04 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4238,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:04 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4237,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:03 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4236,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:03 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4235,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:03 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4234,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:03 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4233,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:03 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4232,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:03 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4231,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:03 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4230,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:03 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4229,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:02 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
4228,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:02 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4227,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:02 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4226,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:02 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4225,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:02 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xb7fd    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege  "
4224,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:02 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xb79b    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
4223,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:02 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xb7fd   Linked Logon ID:  0xb79b   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x228   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4222,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:02 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xb79b   Linked Logon ID:  0xb7fd   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x228   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4221,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:02 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  DWM-1   Account Domain:  Window Manager   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x228   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4220,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:01 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4219,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:01 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4218,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:01 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
4217,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:01 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4216,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:01 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4215,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:01 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4214,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:01 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
4213,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:01 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4212,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:01 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-1   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon ID:  0x733e   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x228   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4211,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:01 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x228   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4210,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:01 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-0   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon ID:  0x7350   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1c8   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4209,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:01 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1c8   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
4208,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:01 AM,4902,None,"The Per-user audit policy table was created.    Number of Elements: 0  Policy ID: 0x71a4  "
4207,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:01 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Logon Information:   Logon Type:  0   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  -    New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4   Process Name:  ?    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  -   Authentication Package: -   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
4206,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:01 AM,4608,None,"Windows is starting up.    This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.  "
4205,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:01 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x25c   New Process Name: ??????????????e??? ????????? ???????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1c8   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4204,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:00 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x250   New Process Name: ????????????????-??6??8????0--?0???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1c8   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4203,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:00 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x228   New Process Name: ????????????????-??6??0????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1c0   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4202,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:00 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1d8   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1c0   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4201,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:00 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1c8   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x170   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4200,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:00 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1c0   New Process Name: ??????????????-??6??0????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x120   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4199,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:00 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x178   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x170   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4198,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:00 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x170   New Process Name: ??????????????-??6??0????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x120   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4197,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:56:59 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x134   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x120   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4196,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:56:58 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x120   New Process Name: ??????????????-??6?4????0--?0???????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x4   Creator Process Name: ???????   Process Command Line: ????0--?0???????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
4195,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:56:58 AM,4826,None,"Boot Configuration Data loaded.    Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    General Settings:   Load Options:  -   Advanced Options:  No     Configuration Access Policy: Default     System Event Logging: No     Kernel Debugging: No     VSM Launch Type: Off      Signature Settings:   Test Signing:  No     Flight Signing:  No     Disable Integrity Checks: No      HyperVisor Settings:   HyperVisor Load Options: -   HyperVisor Launch Type: Off     HyperVisor Debugging: No    "
4194,Security,Microsoft-Windows-Eventlog,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 6:57:03 AM,1101,None,"Audit events have been dropped by the transport.  0  "
4193,Security,Microsoft-Windows-Eventlog,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:56 AM,1100,None,"The event logging service has shut down.  "
4192,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:26 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\TextInput\WindowsInternal.ComposableShell.Experiences.TextInput.LayoutData.dll   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4191,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:26 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\TextInput\WindowsInternal.ComposableShell.Experiences.TextInput.dll   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4190,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:26 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Web.winmd   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4189,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:26 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.UI.Xaml.winmd   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4188,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:26 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.UI.winmd   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4187,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:26 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.System.winmd   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4186,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:26 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Storage.winmd   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4185,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:26 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Services.winmd   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4184,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:26 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Security.winmd   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4183,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:26 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Perception.winmd   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4182,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:26 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Networking.winmd   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4181,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:26 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Media.winmd   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4180,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:26 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Management.winmd   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4179,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:26 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Graphics.winmd   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4178,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:26 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Globalization.winmd   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4177,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:26 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Gaming.winmd   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4176,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:26 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Foundation.winmd   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4175,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:26 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Devices.winmd   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4174,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:26 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Data.winmd   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4173,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:26 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.ApplicationModel.winmd   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4172,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:26 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Speech_OneCore\common\sapi_onecore.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4171,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:26 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\migration\PlaMig.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4170,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:26 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\IME\IMETC\IMTCCORE.DLL   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4169,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:26 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\IME\IMEJP\IMJPAPI.DLL   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4168,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:26 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Dism\AppxProvider.dll   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4167,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\WWAHost.exe   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4166,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\WwaApi.dll   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4165,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\wuapi.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4164,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\wscript.exe   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4163,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\winmde.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4162,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\wininet.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4161,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\winhttp.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4160,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Windows.UI.Xaml.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4159,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Windows.UI.Input.Inking.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4158,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Windows.UI.Immersive.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4157,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\windows.storage.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4156,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Windows.Services.TargetedContent.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4155,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Windows.Perception.Stub.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4154,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Windows.Networking.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4153,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Windows.Mirage.Internal.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4152,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Windows.Mirage.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4151,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Windows.Media.Protection.PlayReady.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4150,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4149,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Windows.ApplicationModel.Store.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4148,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Windows.ApplicationModel.LockScreen.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4147,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\win32kfull.sys   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4146,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\wimgapi.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4145,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\vbscript.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4144,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\usoapi.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4143,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\usercpl.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4142,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\user32.dll   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4141,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\urlmon.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4140,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\updatepolicy.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4139,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\ucrtbase.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4138,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\tzres.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4137,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\twinui.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4136,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\TileDataRepository.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4135,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\t2embed.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4134,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\storagewmi.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4133,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\SRH.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4132,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\sppcext.dll   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4131,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\SpatializerApo.dll   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4130,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\SndVolSSO.dll   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4129,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\smartscreenps.dll   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4128,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\slcext.dll   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4127,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\shell32.dll   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4126,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\scrobj.dll   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4125,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\msxml6.dll   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4124,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\msxml3.dll   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4123,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\msvproc.dll   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4122,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\msvcrt.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4121,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\msscript.ocx   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4120,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\msIso.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4119,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\mshtml.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4118,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\mispace.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4117,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\mfsvr.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4116,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\mfplat.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4115,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\MFMediaEngine.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4114,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\LockAppBroker.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4113,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\LicenseManager.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4112,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\KeyboardFilterShim.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4111,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\jscript9diag.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4110,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\jscript9.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4109,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\jscript.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4108,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\itss.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4107,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\iprtrmgr.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4106,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\InstallService.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4105,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\iertutil.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4104,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\ieproxy.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4103,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\ieframe.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4102,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\GdiPlus.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4101,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\gdi32full.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4100,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\gamingtcui.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4099,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\FSClient.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4098,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\fontdrvhost.exe   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4097,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\ExplorerFrame.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4096,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\explorer.exe   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4095,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\ExecModelClient.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4094,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\evr.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4093,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\edgeIso.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4092,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\edgehtml.dll   Handle ID: 0x88    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4091,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\dxgi.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4090,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\dwmcore.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4089,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\DictationManager.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4088,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\d3d9on12.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4087,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\d3d9.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4086,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\d3d11.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4085,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\cscript.exe   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4084,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\ContentDeliveryManager.Utilities.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4083,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\comdlg32.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4082,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\CloudExperienceHostCommon.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4081,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Chakradiag.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4080,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Chakra.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4079,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\bcryptprimitives.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4078,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\bcrypt.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4077,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\batmeter.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4076,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\AudioSes.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4075,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\AudioEng.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4074,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\AppxAllUserStore.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4073,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\AppVEntSubsystems32.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4072,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\apphelp.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4071,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\actxprxy.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4070,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\ActivationManager.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4069,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\acppage.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4068,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\AcLayers.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4067,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\AcGenral.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4066,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.UI.ShellCommon\Windows.UI.ShellCommon.pri   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4065,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.UI.SettingsAdminFlowUIThreshold\Windows.UI.SettingsAdminFlowUIThreshold.pri   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4064,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.zh-TW.pri   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4063,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.zh-CN.pri   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4062,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.uk-UA.pri   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4061,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.tr-TR.pri   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4060,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.th-TH.pri   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4059,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.sv-SE.pri   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4058,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.sr-Latn-RS.pri   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4057,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.sl-SI.pri   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4056,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.sk-SK.pri   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4055,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.ru-RU.pri   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4054,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.ro-RO.pri   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4053,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.pt-PT.pri   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4052,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.pt-BR.pri   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4051,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:25 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.pl-PL.pri   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4050,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.nl-NL.pri   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4049,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.nb-NO.pri   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4048,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.lv-LV.pri   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4047,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.lt-LT.pri   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4046,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.ko-KR.pri   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4045,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.ja-JP.pri   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4044,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.it-IT.pri   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4043,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.hu-HU.pri   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4042,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.hr-HR.pri   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4041,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.he-IL.pri   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4040,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.fr-FR.pri   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4039,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.fr-CA.pri   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4038,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.fi-FI.pri   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4037,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.et-EE.pri   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4036,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.es-MX.pri   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4035,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.es-ES.pri   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4034,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.en-US.pri   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4033,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.en-GB.pri   Handle ID: 0x80    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4032,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.el-GR.pri   Handle ID: 0x80    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4031,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.de-DE.pri   Handle ID: 0x80    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4030,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.da-DK.pri   Handle ID: 0x80    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4029,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.cs-CZ.pri   Handle ID: 0x80    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4028,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.bg-BG.pri   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4027,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.ar-SA.pri   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4026,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.Data.TimeZones\Windows.Data.TimeZones.pri   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4025,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\Windows.ApplicationModel.LockScreen\Windows.ApplicationModel.LockScreen.pri   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4024,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\TextInput\TextInput.pri   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4023,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\pris\resources.en-US.pri   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4022,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\resources.pri   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4021,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\MixedRealityPortal.exe   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4020,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\MixedRealityPortal.Brokered.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4019,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\AppxSignature.p7x   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4018,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\AppxManifest.xml   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4017,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\AppxBlockMap.xml   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4016,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4015,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SAPIBackgroundTask.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4014,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\resources.pri   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4013,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll   Handle ID: 0x84    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4012,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\ReactiveAgentsCommon.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4011,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\PlacesServer.exe   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4010,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaSpeechux.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4009,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4008,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.SmartExtraction.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4007,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Signals.dll   Handle ID: 0x88    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4006,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4005,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll   Handle ID: 0x88    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4004,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.AppToApp.dll   Handle ID: 0x88    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4003,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\AppxSignature.p7x   Handle ID: 0x88    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4002,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\AppxManifest.xml   Handle ID: 0x88    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4001,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\AppxBlockMap.xml   Handle ID: 0x88    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
4000,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\ContentManagementSDK.dll   Handle ID: 0x88    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3999,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\ContentDeliveryManager.Background.dll   Handle ID: 0x88    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3998,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobesettings-vm.js   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3997,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobehello-vm.js   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3996,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\js\navmesh.js   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3995,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\js\environment.js   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3994,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\js\core.js   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3993,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\js\appManager.js   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3992,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\data\navigation.json   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3991,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\data\navigation-int.json   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3990,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\core\js\oobe-chrome-footer-vm.js   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3989,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\MicrosoftAccount.TokenProvider.Core.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3988,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\resources.pri   Handle ID: 0x88    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3987,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe   Handle ID: 0x88    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3986,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\eView.dll   Handle ID: 0x88    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3985,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\eModel.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3984,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\EdgeContent.dll   Handle ID: 0x88    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3983,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\pris\resources.en-US.pri   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3982,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\resources.pri   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3981,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentUI.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3980,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\InputApp_cw5n1h2txyewy\WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.exe   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3979,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\InputApp_cw5n1h2txyewy\resources.pri   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3978,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\WinMetadata\Windows.Web.winmd   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3977,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\WinMetadata\Windows.UI.Xaml.winmd   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3976,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\WinMetadata\Windows.UI.winmd   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3975,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\WinMetadata\Windows.System.winmd   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3974,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\WinMetadata\Windows.Storage.winmd   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3973,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\WinMetadata\Windows.Services.winmd   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3972,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\WinMetadata\Windows.Security.winmd   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3971,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\WinMetadata\Windows.Perception.winmd   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3970,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\WinMetadata\Windows.Networking.winmd   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3969,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\WinMetadata\Windows.Media.winmd   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3968,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\WinMetadata\Windows.Management.winmd   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3967,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\WinMetadata\Windows.Graphics.winmd   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3966,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\WinMetadata\Windows.Globalization.winmd   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3965,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\WinMetadata\Windows.Gaming.winmd   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3964,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\WinMetadata\Windows.Foundation.winmd   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3963,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\WinMetadata\Windows.Devices.winmd   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3962,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\WinMetadata\Windows.Data.winmd   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3961,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\WinMetadata\Windows.ApplicationModel.winmd   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3960,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\wbem\WUAProvider.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3959,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\spp\plugin-manifests-signed\sppwinob-spp-plugin-manifest-signed.xrm-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3958,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Speech_OneCore\common\sapi_onecore.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3957,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\oobe\UserOOBE.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3956,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\oobe\msoobeplugins.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3955,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\oobe\msoobedui.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3954,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\migration\TileStoreMigrationPlugin.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3953,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\migration\PlaMig.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3952,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\IME\shared\ImeBroker.exe   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3951,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\IME\IMETC\IMTCCORE.DLL   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3950,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\IME\IMEJP\IMJPAPI.DLL   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3949,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\en-US\tzres.dll.mui   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3948,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\en-US\sppsvc.exe.mui   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3947,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\en-US\sppcext.dll.mui   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3946,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\en-US\slcext.dll.mui   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3945,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\en-US\propsys.dll.mui   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3944,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\en-US\MusNotificationUx.exe.mui   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3943,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\WdiWiFi.sys   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3942,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\vwifimp.sys   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3941,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\srvnet.sys   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3940,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\srv2.sys   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3939,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\nwifi.sys   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3938,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\hvsocket.sys   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3937,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Dism\AppxProvider.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3936,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Boot\winload.exe   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3935,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Boot\winload.efi   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3934,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\appraiser\Appraiser_Data.ini   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3933,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\appraiser\appraiser.sdb   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3932,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\wwansvc.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3931,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\WWAHost.exe   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3930,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\WwaApi.dll   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3929,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\wuuhosdeployment.dll   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3928,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\wuuhext.dll   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3927,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\wuautoappupdate.dll   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3926,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\wuaueng.dll   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3925,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\wuauclt.exe   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3924,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\wuapi.dll   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3923,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\wscript.exe   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3922,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\WpAXHolder.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3921,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\wow64.dll   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3920,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\winmde.dll   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3919,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\wininet.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3918,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\winhttp.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3917,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Windows.UI.Xaml.Resources.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3916,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Windows.UI.Xaml.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3915,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Windows.UI.Input.Inking.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3914,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Windows.UI.Immersive.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3913,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\windows.storage.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3912,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Windows.Services.TargetedContent.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3911,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Windows.Perception.Stub.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3910,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Windows.Networking.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3909,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Windows.Mirage.Internal.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3908,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Windows.Mirage.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3907,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Windows.Media.Protection.PlayReady.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3906,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Windows.CloudStore.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3905,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Windows.ApplicationModel.Store.TestingFramework.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3904,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Windows.ApplicationModel.Store.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3903,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Windows.ApplicationModel.LockScreen.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3902,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\win32kfull.sys   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3901,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\win32kbase.sys   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3900,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\wimserv.exe   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3899,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\wimgapi.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3898,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\WebRuntimeManager.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3897,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\vbscript.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3896,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\vac.exe   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3895,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\usocore.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3894,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\usoapi.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3893,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\usercpl.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3892,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\user32.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3891,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\urlmon.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3890,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\updatepolicy.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3889,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\UpdateAgent.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3888,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\umpo.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3887,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ucrtbase.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3886,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\tzres.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3885,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\twinui.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3884,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\TileDataRepository.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3883,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\t2embed.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3882,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\SystemSettingsThresholdAdminFlowUI.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3881,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\SystemSettings.Handlers.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3880,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\storagewmi.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3879,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\StartTileData.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3878,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\SRH.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3877,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\sppwinob.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3876,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\sppsvc.exe   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3875,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\sppcext.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3874,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\SpatializerApo.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3873,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\SndVolSSO.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3872,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\smartscreenps.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3871,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\smartscreen.exe   Handle ID: 0x80    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3870,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\slcext.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3869,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\SIHClient.exe   Handle ID: 0x80    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3868,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\shell32.dll   Handle ID: 0x80    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3867,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\SettingsHandlers_SIUF.dll   Handle ID: 0x80    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3866,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\SettingsHandlers_ContentDeliveryManager.dll   Handle ID: 0x80    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3865,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\SettingsEnvironment.Desktop.dll   Handle ID: 0x80    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3864,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\services.exe   Handle ID: 0x80    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3863,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\SecurityHealthService.exe   Handle ID: 0x80    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3862,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\scrobj.dll   Handle ID: 0x80    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3861,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\schedsvc.dll   Handle ID: 0x80    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3860,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\samsrv.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3859,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ResetEngine.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3858,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\reseteng.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3857,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\RecoveryDrive.exe   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3856,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\PushToInstall.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3855,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\provtool.exe   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3854,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\provisioningcsp.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3853,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\provhandlers.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3852,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\provengine.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3851,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\pnidui.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3850,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\NetworkMobileSettings.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3849,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\MusNotifyIcon.exe   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3848,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\MusNotificationUx.exe   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3847,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\MusNotification.exe   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3846,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\msxml6.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3845,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\msxml3.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3844,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\msvproc.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3843,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\msvcrt.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3842,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\msIso.dll   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3841,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\mshtml.dll   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3840,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\mispace.dll   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3839,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Microsoft.Bluetooth.Profiles.Gatt.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3838,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\mfsvr.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3837,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\mfplat.dll   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3836,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\MFMediaEngine.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3835,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\LogonController.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3834,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\LockAppBroker.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3833,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\LicenseManager.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3832,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\jscript9diag.dll   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3831,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\jscript9.dll   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3830,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\jscript.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3829,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\itss.dll   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3828,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ISM.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3827,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\iprtrmgr.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3826,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ipnathlp.dll   Handle ID: 0x80    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3825,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:23 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\InstallService.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3824,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\iertutil.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3823,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ieproxy.dll   Handle ID: 0x80    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3822,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ieframe.dll   Handle ID: 0x80    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3821,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Hydrogen.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3820,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\hvix64.exe   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3819,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\hvax64.exe   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3818,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\HolographicExtensions.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3817,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\HologramCompositor.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3816,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\hascsp.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3815,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\generaltel.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3814,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\GdiPlus.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3813,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\gdi32full.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3812,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\gamingtcui.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3811,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\FSClient.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3810,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\fontdrvhost.exe   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3809,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ExplorerFrame.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3808,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ExecModelClient.dll   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3807,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\evr.dll   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3806,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\edgeIso.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3805,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\edgehtml.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3804,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\dxgi.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3803,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\dwmcore.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3802,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\dusmsvc.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3801,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\dmcertinst.exe   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3800,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\DictationManager.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3799,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\DHolographicDisplay.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3798,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\DeviceUpdateAgent.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3797,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\DeviceSetupManager.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3796,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\d3d9on12.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3795,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\d3d9.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3794,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\d3d11.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3793,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\cscript.exe   Handle ID: 0x7c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3792,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\cryptcatsvc.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3791,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ContentDeliveryManager.Utilities.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3790,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\comdlg32.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3789,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\CloudExperienceHostCommon.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3788,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\CloudExperienceHost.dll   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3787,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Chakradiag.dll   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3786,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Chakra.dll   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3785,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\browserbroker.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3784,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\bisrv.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3783,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\bcryptprimitives.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3782,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\bcrypt.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3781,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\batmeter.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3780,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\audiosrv.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3779,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\AudioSes.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3778,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\AudioEng.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3777,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\AudioEndpointBuilder.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3776,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\audiodg.exe   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3775,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\AppXDeploymentServer.dll   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3774,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\AppXDeploymentExtensions.onecore.dll   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3773,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\AppXDeploymentExtensions.desktop.dll   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3772,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\AppxAllUserStore.dll   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3771,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\AppVReporting.dll   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3770,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\AppVPublishing.dll   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3769,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\AppVOrchestration.dll   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3768,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\AppVIntegration.dll   Handle ID: 0x80    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3767,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\AppVEntVirtualization.dll   Handle ID: 0x80    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3766,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\AppVEntSubsystems64.dll   Handle ID: 0x80    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3765,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\AppVEntSubsystemController.dll   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3764,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\AppVEntStreamingManager.dll   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3763,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\AppVCatalog.dll   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3762,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\appraiser.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3761,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\apphelp.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3760,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\actxprxy.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3759,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ActivationManager.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3758,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\acppage.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3757,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\acmigration.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3756,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\AcLayers.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3755,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\AcGenral.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3754,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\aadjcsp.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3753,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\ShellExperiences\WindowsInternal.People.PeoplePicker.dll   Handle ID: 0x78    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3752,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\ShellExperiences\Windows.UI.ActionCenter.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3751,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\ShellExperiences\StartUI.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3750,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\ShellExperiences\JumpViewUI.dll   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3749,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Provisioning\Cosa\Microsoft\Microsoft.Windows.Cosa.Desktop.Client.ppkg   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3748,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Provisioning\Microsoft-Desktop-Provisioning.dat   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3747,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat   Handle ID: 0x74    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3746,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\INF\apps.inf   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3745,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Globalization\Time Zone\timezones.xml   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3744,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Globalization\Time Zone\timezoneMapping.xml   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3743,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3742,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Boot\PCAT\qps-ploc\bootmgr.exe.mui   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3741,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Boot\DVD\EFI\en-US\efisys_noprompt.bin   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3740,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Boot\DVD\EFI\en-US\efisys.bin   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3739,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\apppatch\sysmain.sdb   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3738,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\apppatch\drvmain.sdb   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3737,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\explorer.exe   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3736,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Program Files (x86)\Internet Explorer\iexplore.exe   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3735,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)  "
3734,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)  "
3733,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Program Files\Windows Defender\wdnsfltr.exe   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3732,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Program Files\internet explorer\iexplore.exe   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3731,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$recycle.bin.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3730,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\perflogs_admin_51abcd79eca668bf.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3729,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\perflogs.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3728,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\program_files_internet_explorer_a421d1bfaf856e2b.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3727,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\program_files_windows_defender_3e33901162166ae9.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3726,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\program_files_windows_defender_advanced_threat_protection_096829c909d5eb56.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3725,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\program_files_windowsapps_deleted_382e0caddd5f5e75.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3724,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\program_files_windowsapps_8909e9aceeb80d44.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3723,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\program_files_ffd0cbfc813cc4f1.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3722,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\program_files_x86_internet_explorer_cafab575245eacb0.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3721,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\program_files_x86__676bbe2c7241b694.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3720,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_appv_setup_c6b9e738c86ef84a.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3719,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_diagnosis_offlinesettings_3d82d09728c650a9.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3718,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_diagnosis_af2ddc54e6a8e491.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3717,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_provisioning_assetcache_cellularux_843105bb528cd98c.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3716,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_provisioning_assetcache_8fbe865af4949dd7.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3715,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_provisioning_929be8282aecbf17.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3714,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_speech_onecore_587c58cfbeda0062.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3713,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_user_account_pictures_eceaafe818cb6141.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3712,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_apprepository_families_5e2e105f8c5e974e.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3711,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_apprepository_packages_711aa2dd7039ca9d.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3710,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_apprepository_3e49394d38e6ac94.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3709,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_devicemetadatastore_2e1ff34936d2e8e5.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3708,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_gameexplorer_eb83b477ca9834cc.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3707,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_packagedeventproviders_c79719361ec06661.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3706,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_startup_b13751030220a596.cdf-ms   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3705,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_d672ba09d81e87ff.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3704,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_fde55420546edfe6.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3703,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_templates_15e72976404301fc.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3702,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_cae2264614449191.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3701,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_defender_advanced_threat_protection_cache_946bebb1e45d47cb.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3700,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_defender_advanced_threat_protection_temp_7268e2d9fd6b25f5.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3699,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_defender_advanced_threat_protection_827f103853495477.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3698,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_security_health_health_advisor_caf4bd491726b327.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3697,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_security_health_logs_d0133fe6679072ac.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3696,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_security_health_ef9cc294168a8b97.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3695,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_fe5c6d762edd2110.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3694,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_softwaredistribution_ae0bdc9bb1bbdfab.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3693,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3692,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_local_microsoft_windows_gameexplorer_5a14824a005868dd.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3691,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_local_microsoft_windows_history_f4337fe0129e212c.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3690,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_local_microsoft_windows_inetcache_93b6f38324ca2118.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3689,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:22 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_local_microsoft_windows_inetcookies_706c818672b5499f.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3688,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_local_microsoft_windows_9e28651fd972d480.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3687,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_local_microsoft_3433db0fbe07ab7f.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3686,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_local_temp_3274946c96022019.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3685,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_local_bc5dd6ae41aaaeeb.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3684,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_internet_explorer_quick_launch_c0ec1d6b06e5808b.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3683,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_windows_network_shortcuts_cbcbd4ac7028a985.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3682,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_windows_recent_ca449f9bba09f987.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3681,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_windows_sendto_cc2b2363b7303311.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3680,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_windows_start_menu_5eb528778fd8d821.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3679,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_windows_templates_9327e87141b4e78f.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3678,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_windows_4793cab2f72cc262.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3677,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_b898cfd29d5951f1.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3676,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_roaming_482f0bdd00d1643d.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3675,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_33f0d5f51e505ec2.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3674,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_desktop_39aa59e1159d1203.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3673,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_documents_a9a4e48ccdf32dcf.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3672,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_downloads_d0a063ac92c2c070.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3671,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_favorites_d09a481c8ccc2a28.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3670,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_links_4064ed15230be7d0.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3669,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_music_4066f7392302d756.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3668,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_pictures_209185c2b71537e4.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3667,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_saved_games_57aaea1c026aa551.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3666,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_videos_4078dfd58aff2cd5.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3665,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_default_73615b64075aa65f.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3664,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_public_desktop_2377dac7383055bd.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3663,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_public_documents_70461e22eba239ef.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3662,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_public_downloads_631cc37cff593fe6.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3661,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_public_libraries_de6591322faedac0.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3660,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_public_music_8c1f3dc399e79184.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3659,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_public_pictures_f5e7b0c0fda4db8c.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3658,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_public_videos_20f7329ef941f593.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3657,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users_public_8c076a3be22985a1.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3656,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\users.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3655,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_appcompat_appraiser_telemetry_94274e99519f58a9.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3654,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_appcompat_appraiser_33781004733ffeee.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3653,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_apppatch_custom_custom64_12107ab6726c35e5.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3652,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_apppatch_custom_2adff76bea4847ec.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3651,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_apppatch_customsdb_3bf1ff155493adb9.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3650,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_apppatch_1143992cbbbebcab.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3649,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_dvd_efi_en-us_8245c3aed97c0844.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3648,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_dvd_efi_de3c4ceb52549e1c.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3647,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_pcat_qps-ploc_109d95b40d3e11cb.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3646,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_pcat_0f8924c0debe64e4.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3645,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_40104b85a18bfcb2.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3644,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_containers_serviced_07c9b2b35f82b615.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3643,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_globalization_time_zone_08f498d155d3913e.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3642,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_globalization_0fc22903a221b67f.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3641,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_ime_imetc_dicts_b6bb60758b345dca.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3640,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_ime_imetc_help_7cd8fd160d71b81c.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3639,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_ime_imetc_0d348c40e45e62ef.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3638,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_ime_3f581be9a4c8cabd.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3637,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_inf_3f581daba4c8c835.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3636,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_infusedapps_applications_99ce33eb6e404069.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3635,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_infusedapps_frameworks_d47684d75fb899e3.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3634,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_infusedapps_packages_b84f23a820de5b5b.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3633,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_infusedapps_2a029e85a52e7b12.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3632,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_pla_reports_a2604845b2b380ca.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3631,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_pla_rules_0bde462ce96f215e.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3630,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_pla_system_571618c4f89c6368.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3629,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_pla_templates_139a41e9c234e4ce.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3628,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_provisioning_cosa_microsoft_77338a94bd8669dd.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3627,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_provisioning_cosa_oem_c5f03ab2bad804ca.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3626,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_provisioning_cosa_b2feb78251a8a259.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3625,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_provisioning_packages_e07c8f8a91f541c4.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3624,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_provisioning_cc9458acec1840ff.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3623,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_shellexperiences_2912c63bd045ac45.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3622,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_appraiser_59bebec9f06db09b.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3621,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_appv_066541f9df2fc831.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3620,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_boot_06654401df2fc50e.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3619,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_codeintegrity_e9af9308cfc26dc2.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3618,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_dism_066548addf2fbd4b.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3617,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_drivers_dc1b782427b5ee1b.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3616,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_en-us_429cd25484dc6f94.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3615,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_icsxml_1f8f393b196e65ae.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3614,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ime_imejp_e3d40370a148c91a.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3613,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ime_imetc_applets_6d36ac75fb0330ae.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3612,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ime_imetc_e3d3eac2a148ee29.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3611,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ime_shared_5a5b3a5824d8fee4.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3610,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_logfiles_sam_5b4992809d2e7248.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3609,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_logfiles_scm_5b4992849d2e7236.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3608,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_migration_927a21df1acd7c18.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3607,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_oobe_06655c95df2fa06f.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3606,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_speech_onecore_common_en-us_1c7d86f233c96fa1.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3605,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_speech_onecore_common_60bf750299e8ab15.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3604,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_speech_onecore_voiceactivation_57f72a0344e2d398.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3603,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_spp_plugin-manifests-signed_d1e9d31c180bebd2.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3602,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_spp_store_2.0_774a618ff1521716.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3601,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_tasks_microsoft_windows_pla_system_a0962b23ba4890f1.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3600,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_tasks_microsoft_windows_pla_0421687103a4975c.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3599,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_tasks_microsoft_windows_taskscheduler_2a138755a33c530b.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3598,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_tasks_microsoft_windows_a67c0a7b7fef87b3.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3597,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_tasks_microsoft_b7abd682baafefc2.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3596,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_tasks_5f1dd67a5a1ae70e.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3595,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_wbem_06656d9fdf2f8577.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3594,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_winmetadata_0c48e99293678cff.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3593,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3592,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_inputapp_cw5n1h2txyewy_assets_fonts_e8459e44c2b9b728.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3591,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_inputapp_cw5n1h2txyewy_assets_154aa123a347aa26.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3590,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_inputapp_cw5n1h2txyewy_9df2da13dd3956d1.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3589,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.bioenrollment_cw5n1h2txyewy_fonts_f2b30f7dd2e0fe08.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3588,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.bioenrollment_cw5n1h2txyewy_pris_f9ee3e9148083766.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3587,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.bioenrollment_cw5n1h2txyewy_0e6f6a5d1f5a1430.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3586,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_applicationguard_8359e7f74deb583c.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3585,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_booklibrary_3e904335483f7fff.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3584,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_bookviewer_css_38b1881b8abcd7a5.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3583,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_bookviewer_js_78c5ff49aa9e261b.cdf-ms   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3582,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_bookviewer_990e8d61fcad5c14.cdf-ms   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3581,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_errorpages_73ec08ffb6105e23.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3580,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_fonts_206f147a74e786c9.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3579,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_hostextensions_autoformfill_content_5091a4e29314f3d6.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3578,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_hostextensions_autoformfill_document_3a04a7fa7c0c1008.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3577,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_hostextensions_autoformfill_prefill_578958a487bb2d19.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3576,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_hostextensions_autoformfill_dcb3be839f31d5cd.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3575,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_hostextensions_learningtools_25cb263578b00eec.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3574,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_persona_4fd2132d4ad15439.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3573,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_readingview_css_3066d24b0856bea1.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3572,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_readingview_e64e82231b0e5fce.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3571,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_webnotes_febc6b7abccb2874.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3570,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_f8075bc7ad02362b.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3569,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_pris_4719a634d2c04eec.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3568,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_43d095bdcce4e130.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3567,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_core_js_applaunchers_de40849bf361043c.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3566,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_core_js_2a738435bdbe8f70.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3565,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_core_view_c303ad0c866a9c46.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3564,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_core_443623ff27fc6f6b.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3563,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_css_b0f49fc4f34fda43.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3562,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_data_4436285d27fc685e.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3561,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_fonts_f53d61bc0b5bbe04.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3560,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_images_f5434c400d60dd7c.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3559,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_js_91283bc423026fc5.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3558,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_lib_b0f47f90f3500a51.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3557,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_media_f54b539a0b1cc81a.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3556,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_microsoft.winjs_css_ae6e5f1669450b38.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3555,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_microsoft.winjs_js_en-us_597bb9eee315d768.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3554,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_microsoft.winjs_js_73de36d3c11d462a.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3553,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_pris_4436110b27fc8d08.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3552,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_retaildemo_d6007de2c4449ca2.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3551,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_0407_f24be5301cd5ef35.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3550,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_0409_f24be8fc1cd5e983.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3549,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_040c_f24bfbf81cd5cd09.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3548,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_0410_f24bd7e61cd60325.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3547,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_0411_f24bd9cc1cd6004c.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3546,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_0416_f24be34a1cd5f20f.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3545,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_0804_f24bdf861cd5f79c.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3544,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_0809_f24be9041cd5e95f.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3543,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_080a_f24bf8341cd5d297.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3542,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_0c09_f24be91a1cd5e8fc.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3541,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_0c0a_f24bf84a1cd5d234.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3540,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_0c0c_f24bfc161cd5cc82.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3539,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_1009_f24be8d01cd5e9f8.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3538,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_4009_f24be8641cd5eaeb.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3537,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_f55759080d09bc14.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3536,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_views_f55d581a0acbb522.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3535,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_enterprisengcenrollment_js_c58adfa13ec3cacc.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3534,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_enterprisengcenrollment_vi_7e71e645381609fd.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3533,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_enterprisengcenrollment_82255765359ba571.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3532,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_inclusiveoobe_css_9d5145ddb46283ae.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3531,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_inclusiveoobe_js_common_9b35fdf5c98f69bb.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3530,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_inclusiveoobe_js_fed525f87d913b20.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3529,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_inclusiveoobe_media_fff1539a1a4e3fb7.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3528,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_inclusiveoobe_view_templat_72e2a4dd8431fbed.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3527,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_inclusiveoobe_view_9d516b3c2e3e1a84.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3526,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_inclusiveoobe_d9ae09c5d2ccd3fb.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3525,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_inclusivesspr_js_04768872769d851d.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3524,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_inclusivesspr_view_a30cd40228c98533.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3523,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_inclusivesspr_d9ae0f7fd2cccc94.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3522,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_surfacehubdeviceuser_js_b837e3558be51686.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3521,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_surfacehubdeviceuser_view_878bf08afd4f7608.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3520,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_surfacehubdeviceuser_40a8494b26aff035.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3519,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_unifiedenrollment_js_c50fa6bbbb7c87b1.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3518,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_unifiedenrollment_views_ab3b53e7951674ac.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3517,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_unifiedenrollment_608128e0971fe102.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3516,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_0c3414e5ea9b964c.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3515,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_e92250ef2519d1f6.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3514,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.contentdeliverymanager_cw5n1h2txyewy_images_f48d365ca6bf839f.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3513,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.contentdeliverymanager_cw5n1h2txyewy_6369fdd3e5ab0989.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3512,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_2d6b8920d3f31e0d.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3511,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.holographicfirstrun_cw5n1h2txyewy_assets_fa2d54e2d81dc483.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3510,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.holographicfirstrun_cw5n1h2txyewy_pris_960a16f2012eced2.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3509,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.holographicfirstrun_cw5n1h2txyewy_dabe890a6e455bec.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3508,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_textinput_pris_c0bd418e6ad3668b.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3507,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_textinput_7145b1667a9c024f.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3506,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.applicationmodel.lockscreen_pris_de46d3c67a43a587.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3505,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.applicationmodel.lockscreen_d0e0107729c97a93.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3504,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.data.timezones_pris_4fe1d707bdf60b69.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3503,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.data.timezones_d6ed24e35548e087.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3502,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.settingsadminflowuithreshold_pris_8eb5d62ebc93ca12.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3501,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.settingsadminflowuithreshold_systemsettingsthresholdadminflowui_assets_45f5e040701cd097.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3500,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.settingsadminflowuithreshold_systemsettingsthresholdadminflowui_assets_5ec4ff00d0d98653.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3499,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.settingsadminflowuithreshold_systemsettingsthresholdadminflowui_a2baca8046478552.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3498,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.settingsadminflowuithreshold_80571585edc0bc10.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3497,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.shellcommon_0eb1b891774fd848.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3496,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_0307ca33e1cd9708.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3495,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_dism_1bf2381fbb30eb13.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3494,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_drivers_193c6528ad70a5e7.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3493,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_en-us_9e576ab077991fe8.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3492,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:21 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_icsxml_468761bf82e091a8.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3491,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ime_imejp_0f2986100e0c2dc6.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3490,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ime_imetc_applets_4cc083d5c906ff5a.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3489,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ime_imetc_0f296d620e0c52d5.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3488,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_logfiles_lsa_5371ea7113e5392b.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3487,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_logfiles_sam_5371e95113e53c10.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3486,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_migration_bdcfa47e8790e0c4.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3485,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_speech_onecore_common_en-us_93d22aa1fb70f6d5.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3484,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_speech_onecore_common_3ac1627a1b848769.cdf-ms   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3483,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_speech_onecore_voiceactivation_64af56b9bf516892.cdf-ms   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3482,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_tasks_microsoft_windows_pla_system_ef7b624670793a77.cdf-ms   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3481,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_tasks_microsoft_windows_pla_7b760bd0cb4c1e90.cdf-ms   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3480,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_tasks_microsoft_windows_taskscheduler_4346cbc4150b5b5f.cdf-ms   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3479,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_tasks_microsoft_windows_4e7d28a223eef37f.cdf-ms   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3478,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_tasks_microsoft_200b1d7e84f3818e.cdf-ms   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3477,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_tasks_bad86ed64cd79762.cdf-ms   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3476,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_winmetadata_047140633426c833.cdf-ms   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3475,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_21ffbdd2a2dd92e0.cdf-ms   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3474,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_textinput_fb44238906e335d1.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3473,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3472,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\_0000000000000000.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3471,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\sspicli.dll   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3470,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\volsnap.sys   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3469,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\rdbss.sys   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3468,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\partmgr.sys   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3467,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\ntfs.sys   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3466,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\ndis.sys   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3465,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\mrxsmb20.sys   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3464,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\mrxsmb.sys   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3463,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\ksecdd.sys   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3462,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\ks.sys   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3461,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\fltMgr.sys   Handle ID: 0x68    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3460,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\dxgmms2.sys   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3459,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\dxgkrnl.sys   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3458,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\cng.sys   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3457,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\clfs.sys   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3456,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\bam.sys   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3455,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\winresume.exe   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3454,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\winresume.efi   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3453,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\winload.exe   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3452,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\winload.efi   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3451,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\sspisrv.dll   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3450,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\sspicli.dll   Handle ID: 0x70    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3449,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ntoskrnl.exe   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3448,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\lsasrv.dll   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3447,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\hal.dll   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3446,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ci.dll   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3445,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\AppVClient.exe   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3444,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\INF\errata.inf   Handle ID: 0x64    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3443,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:20 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Boot\PCAT\bootmgr   Handle ID: 0x5c    Process Information:   Process ID: 0x1a68   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
3442,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:16 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3441,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:16 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3440,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:15 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3439,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:15 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3438,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:15 AM,4647,None,"User initiated logoff:    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1590e    This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.  "
3437,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:05 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3436,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 5:49:05 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3435,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 4:58:42 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3434,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 4:58:42 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3433,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 4:57:13 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3432,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 4:57:13 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3431,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 4:57:12 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3430,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 4:57:12 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3429,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 4:48:04 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3428,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 4:48:04 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3427,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 4:24:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3426,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 4:24:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3425,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 4:01:08 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3424,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 4:01:08 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3423,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 3:58:38 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3422,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 3:58:38 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3421,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 3:58:36 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3420,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 3:58:36 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3419,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 3:58:35 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3418,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 3:58:35 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3417,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 3:58:30 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3416,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 3:58:30 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3415,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 3:58:30 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-501   Account Name:  Guest   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xdc4   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
3414,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 3:48:34 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3413,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 3:48:34 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3412,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 3:48:25 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3411,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 3:48:25 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3410,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/20/2017 3:24:17 AM,4616,None,"The system time was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Process Information:   Process ID: 0x95c   Name:  C:\Program Files\VMware\VMware Tools\vmtoolsd.exe    Previous Time:  2017-12-20T06:38:13.525329300Z  New Time:  2017-12-20T11:24:17.028000000Z    This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.  "
3409,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 10:34:17 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3408,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 10:34:17 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3407,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 10:33:37 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3406,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 10:33:37 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3405,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 10:33:29 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3404,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 10:33:29 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3403,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 10:29:53 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3402,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 10:29:53 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3401,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 10:17:41 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3400,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 10:17:41 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3399,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 10:09:01 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3398,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 10:09:01 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3397,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 10:04:35 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3396,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 10:04:35 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3395,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 10:03:30 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3394,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 10:03:30 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3393,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 10:00:53 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3392,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 10:00:53 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3391,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 9:52:13 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3390,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 9:52:13 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3389,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 9:52:02 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3388,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 9:52:02 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3387,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 9:25:44 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3386,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 9:25:44 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3385,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 9:25:35 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3384,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 9:25:35 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3383,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:59:22 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3382,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:59:22 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3381,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:46:05 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3380,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:46:05 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3379,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:46:01 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x174c   Process Name:  C:\Windows\System32\svchost.exe  "
3378,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:46:01 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x174c   Process Name:  C:\Windows\System32\svchost.exe  "
3377,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:46:00 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3376,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:46:00 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3375,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:40:05 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3374,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:40:05 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3373,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:33:56 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x1aec   Process Name:  C:\Windows\System32\VSSVC.exe  "
3372,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:33:56 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x1aec   Process Name:  C:\Windows\System32\VSSVC.exe  "
3371,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:33:56 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x1aec   Process Name:  C:\Windows\System32\VSSVC.exe  "
3370,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:33:56 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x1aec   Process Name:  C:\Windows\System32\VSSVC.exe  "
3369,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:33:56 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x1aec   Process Name:  C:\Windows\System32\VSSVC.exe  "
3368,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:33:56 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x1aec   Process Name:  C:\Windows\System32\VSSVC.exe  "
3367,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:33:56 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x1aec   Process Name:  C:\Windows\System32\VSSVC.exe  "
3366,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:33:56 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3365,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:33:56 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3364,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:33:56 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x1aec   Process Name:  C:\Windows\System32\VSSVC.exe  "
3363,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:33:56 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3362,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:33:56 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3361,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:33:55 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_logs_cbs_10a752bcbbaee88b.cdf-ms   Handle ID: 0xbe8    Process Information:   Process ID: 0x1fcc   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3360,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:33:55 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_servicing_packages_46c20bc5f833cc43.cdf-ms   Handle ID: 0x454    Process Information:   Process ID: 0x1fcc   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3359,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:33:55 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_servicing_sessions_5591aee9e2456a35.cdf-ms   Handle ID: 0xba4    Process Information:   Process ID: 0x1fcc   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3358,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:33:55 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_servicing_sqm_51d9d5f9de5a2fa5.cdf-ms   Handle ID: 0xbe8    Process Information:   Process ID: 0x1fcc   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3357,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:33:55 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_servicing_version_10.0.16299.96_5cec97245bf0e623.cdf-ms   Handle ID: 0x454    Process Information:   Process ID: 0x1fcc   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3356,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:33:55 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_servicing_fc2045b9046cc796.cdf-ms   Handle ID: 0xba4    Process Information:   Process ID: 0x1fcc   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3355,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:33:55 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_advancedinstallers_dfe2cf200b391371.cdf-ms   Handle ID: 0xf3c    Process Information:   Process ID: 0x1fcc   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3354,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:33:55 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms   Handle ID: 0x454    Process Information:   Process ID: 0x1fcc   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3353,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:33:55 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_advancedinstallers_0c6bb4866bff02f7.cdf-ms   Handle ID: 0xba4    Process Information:   Process ID: 0x1fcc   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3352,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:33:55 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_21ffbdd2a2dd92e0.cdf-ms   Handle ID: 0x56c    Process Information:   Process ID: 0x1fcc   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3351,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:33:55 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$.cdf-ms   Handle ID: 0x454    Process Information:   Process ID: 0x1fcc   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3350,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:33:55 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\_0000000000000000.cdf-ms   Handle ID: 0xba4    Process Information:   Process ID: 0x1fcc   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
3349,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:30:25 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3348,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:30:25 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3347,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:30:22 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3346,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:30:22 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3345,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:28:37 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3344,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:28:37 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3343,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:28:33 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3342,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:28:33 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3341,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:28:17 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3340,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:28:17 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3339,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:28:11 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3338,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:28:11 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3337,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:28:10 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3336,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:28:10 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3335,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:24:50 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3334,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:24:50 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3333,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:09:36 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3332,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:09:36 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3331,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:04:58 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3330,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 8:04:58 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3329,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 7:54:33 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3328,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 7:54:33 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3327,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 7:47:49 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3326,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 7:47:49 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3325,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 7:36:23 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3324,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 7:36:23 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3323,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 7:24:03 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3322,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 7:24:03 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3321,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 7:17:23 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3320,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 7:17:23 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3319,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 7:08:49 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3318,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 7:08:49 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3317,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 7:04:38 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3316,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 7:04:38 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3315,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 6:53:34 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3314,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 6:53:34 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3313,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 6:49:40 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3312,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 6:49:40 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3311,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 6:49:12 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3310,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 6:49:12 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3309,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 6:47:39 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3308,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 6:47:39 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3307,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 6:44:28 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3306,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 6:44:28 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3305,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 6:38:31 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3304,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 6:38:31 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3303,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 6:23:16 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3302,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 6:23:16 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3301,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 6:08:02 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3300,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 6:08:02 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3299,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 5:50:22 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3298,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 5:50:22 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3297,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 5:47:05 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3296,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 5:47:05 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3295,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 5:46:57 PM,4634,None,"An account was logged off.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x452a83    Logon Type:   2    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.  "
3294,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 5:46:57 PM,4634,None,"An account was logged off.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x452aa2    Logon Type:   2    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.  "
3293,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 5:46:57 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x452a83    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3292,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 5:46:57 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x452aa2   Linked Logon ID:  0x452a83   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4d4   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3291,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 5:46:57 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x452a83   Linked Logon ID:  0x452aa2   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4d4   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3290,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 5:46:57 PM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x4d4   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
3289,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 5:44:34 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x618   Process Name:  C:\Windows\System32\LogonUI.exe  "
3288,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 5:37:33 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3287,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 5:37:33 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3286,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 5:30:06 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3285,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 5:30:06 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3284,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 5:22:31 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3283,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 5:22:31 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3282,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 5:18:10 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3281,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 5:18:10 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3280,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 5:08:30 PM,4616,None,"The system time was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Process Information:   Process ID: 0x95c   Name:  C:\Program Files\VMware\VMware Tools\vmtoolsd.exe    Previous Time:  2017-12-20T00:19:13.693642300Z  New Time:  2017-12-20T01:08:30.874000000Z    This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.  "
3279,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:18:06 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3278,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:18:06 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3277,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:18:00 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1590e    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: WDAGUtilityAccount   Target Account Domain: MSEDGEWIN10  "
3276,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:18:00 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1590e    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: sshd_server   Target Account Domain: MSEDGEWIN10  "
3275,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:18:00 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1590e    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: sshd   Target Account Domain: MSEDGEWIN10  "
3274,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:18:00 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1590e    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Guest   Target Account Domain: MSEDGEWIN10  "
3273,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:18:00 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1590e    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: DefaultAccount   Target Account Domain: MSEDGEWIN10  "
3272,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:18:00 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1590e    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Administrator   Target Account Domain: MSEDGEWIN10  "
3271,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:17:13 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3270,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:17:13 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3269,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:17:12 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3268,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:17:12 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3267,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:16:30 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3266,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:16:30 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3265,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:13:02 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xedc   Process Name:  C:\Windows\System32\VSSVC.exe  "
3264,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:13:02 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xedc   Process Name:  C:\Windows\System32\VSSVC.exe  "
3263,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:13:02 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xedc   Process Name:  C:\Windows\System32\VSSVC.exe  "
3262,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:13:02 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3261,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:13:02 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3260,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:13:02 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xedc   Process Name:  C:\Windows\System32\VSSVC.exe  "
3259,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:13:02 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xedc   Process Name:  C:\Windows\System32\VSSVC.exe  "
3258,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:13:02 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xedc   Process Name:  C:\Windows\System32\VSSVC.exe  "
3257,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:13:02 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xedc   Process Name:  C:\Windows\System32\VSSVC.exe  "
3256,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:13:02 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xedc   Process Name:  C:\Windows\System32\VSSVC.exe  "
3255,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:13:02 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3254,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:13:02 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3253,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:07:47 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3252,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:07:47 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3251,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:07:25 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3250,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:07:25 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3249,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:02:46 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3248,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:02:46 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3247,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:02:44 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3246,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 4:02:44 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3245,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:58:14 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3244,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:58:14 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3243,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:58:12 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3242,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:58:12 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3241,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:58:11 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xa9c   Process Name:  C:\Windows\System32\VSSVC.exe  "
3240,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:58:11 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xa9c   Process Name:  C:\Windows\System32\VSSVC.exe  "
3239,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:58:11 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xa9c   Process Name:  C:\Windows\System32\VSSVC.exe  "
3238,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:58:11 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xa9c   Process Name:  C:\Windows\System32\VSSVC.exe  "
3237,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:58:11 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xa9c   Process Name:  C:\Windows\System32\VSSVC.exe  "
3236,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:58:11 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xa9c   Process Name:  C:\Windows\System32\VSSVC.exe  "
3235,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:58:11 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3234,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:58:11 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3233,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:58:11 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xa9c   Process Name:  C:\Windows\System32\VSSVC.exe  "
3232,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:58:11 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xa9c   Process Name:  C:\Windows\System32\VSSVC.exe  "
3231,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:58:11 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3230,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:58:11 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3229,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:58:11 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3228,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:58:11 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3227,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:58:11 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3226,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:58:11 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3225,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:58:10 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3224,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:58:10 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3223,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:58:10 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3222,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:58:10 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3221,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:52:42 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3220,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:52:42 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3219,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:52:42 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3218,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:52:42 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3217,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:52:07 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3216,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:52:07 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3215,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:51:49 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3214,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:51:49 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3213,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:50:22 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3212,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:50:22 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3211,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:50:17 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3210,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:50:17 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3209,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:50:17 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3208,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:50:17 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3207,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:49:48 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3206,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:49:48 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3205,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:49:48 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3204,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:49:48 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3203,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:49:47 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xd04   Process Name:  C:\Windows\System32\svchost.exe  "
3202,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:49:47 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xd04   Process Name:  C:\Windows\System32\svchost.exe  "
3201,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:49:46 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3200,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:49:46 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3199,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:49:35 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-501   Account Name:  Guest   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1ec8   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
3198,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:49:24 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3197,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:49:24 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3196,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:48:40 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1590e    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: WDAGUtilityAccount   Target Account Domain: MSEDGEWIN10  "
3195,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:48:40 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1590e    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: sshd_server   Target Account Domain: MSEDGEWIN10  "
3194,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:48:40 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1590e    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: sshd   Target Account Domain: MSEDGEWIN10  "
3193,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:48:40 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1590e    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Guest   Target Account Domain: MSEDGEWIN10  "
3192,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:48:40 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1590e    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: DefaultAccount   Target Account Domain: MSEDGEWIN10  "
3191,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:48:40 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1590e    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Administrator   Target Account Domain: MSEDGEWIN10  "
3190,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:48:04 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3189,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:48:04 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3188,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:48:00 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3187,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:48:00 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3186,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:59 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3185,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:59 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3184,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:58 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3183,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:58 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3182,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:57 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3181,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:57 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3180,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:56 PM,5059,None,"Key migration operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Additional Information:   Operation: Export of persistent cryptographic key.     Return Code: 0x0  "
3179,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:56 PM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
3178,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:56 PM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Key File Operation Information:   File Path: C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
3177,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:55 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3176,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:55 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3175,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:51 PM,4634,None,"An account was logged off.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x58a50    Logon Type:   2    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.  "
3174,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:51 PM,4634,None,"An account was logged off.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x58a8e    Logon Type:   2    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.  "
3173,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:51 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x58a50    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3172,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:51 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x58a8e   Linked Logon ID:  0x58a50   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4d4   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3171,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:51 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x58a50   Linked Logon ID:  0x58a8e   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4d4   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3170,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:51 PM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x4d4   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
3169,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:48 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x12ec   Process Name:  C:\Windows\System32\VSSVC.exe  "
3168,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:48 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x12ec   Process Name:  C:\Windows\System32\VSSVC.exe  "
3167,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:48 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x12ec   Process Name:  C:\Windows\System32\VSSVC.exe  "
3166,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:48 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x12ec   Process Name:  C:\Windows\System32\VSSVC.exe  "
3165,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:48 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x12ec   Process Name:  C:\Windows\System32\VSSVC.exe  "
3164,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:48 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x12ec   Process Name:  C:\Windows\System32\VSSVC.exe  "
3163,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:47 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x12ec   Process Name:  C:\Windows\System32\VSSVC.exe  "
3162,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:47 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x12ec   Process Name:  C:\Windows\System32\VSSVC.exe  "
3161,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:47 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x1250   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
3160,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:47 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x1250   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
3159,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:47 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3158,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:47 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3157,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:47 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3156,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:47 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3155,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:47 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x3b0   Process Name:  C:\Windows\System32\LogonUI.exe  "
3154,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:46 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3153,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:46 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3152,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:45 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3151,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:45 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3150,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:44 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x16b16    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xf04   Process Name:  C:\Program Files\OpenSSH\bin\cygrunsrv.exe  "
3149,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:44 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x43c   Process Name:  C:\Windows\System32\svchost.exe  "
3148,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:44 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x43c   Process Name:  C:\Windows\System32\svchost.exe  "
3147,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:44 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3146,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:44 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3145,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:44 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3144,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:44 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3143,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:43 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x918   Process Name:  C:\Windows\System32\svchost.exe  "
3142,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:43 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x918   Process Name:  C:\Windows\System32\svchost.exe  "
3141,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:43 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3140,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:43 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3139,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:43 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x8e8   Process Name:  C:\Windows\System32\svchost.exe  "
3138,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:43 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x8e8   Process Name:  C:\Windows\System32\svchost.exe  "
3137,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:42 PM,5024,None,"The Windows Firewall service started successfully.  "
3136,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:42 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3135,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:42 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3134,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:42 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3133,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:42 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3132,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:42 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3131,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:42 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3130,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:42 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3129,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:42 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3128,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:42 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3127,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:42 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3126,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:42 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3125,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:42 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3124,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:42 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3123,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:42 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3122,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:42 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x16b16    Privileges:  SeCreateTokenPrivilege     SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3121,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:42 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x16b16   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3120,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:42 PM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
3119,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:42 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3118,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:42 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3117,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:42 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3116,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:42 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3115,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:42 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3114,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:42 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3113,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:41 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x15849    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3112,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:41 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1590e   Linked Logon ID:  0x15849   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4d4   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3111,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:41 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x15849   Linked Logon ID:  0x1590e   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4d4   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3110,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:41 PM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x4d4   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
3109,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:41 PM,5033,None,"The Windows Firewall Driver started successfully.  "
3108,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:41 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3107,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:41 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3106,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:41 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3105,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:41 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3104,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:40 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3103,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:40 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3102,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:40 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3101,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:40 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3100,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:40 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3099,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:40 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3098,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:40 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3097,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:40 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3096,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:40 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3095,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:40 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3094,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:40 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3093,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:40 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3092,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:40 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
3091,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:40 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3090,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:40 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbfb1    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege  "
3089,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:40 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbf51    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
3088,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:40 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbfb1   Linked Logon ID:  0xbf51   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x204   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3087,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:40 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbf51   Linked Logon ID:  0xbfb1   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x204   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3086,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:40 PM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  DWM-1   Account Domain:  Window Manager   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x204   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
3085,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:40 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3084,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:40 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3083,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:40 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
3082,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:40 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3081,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:39 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3080,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:39 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3079,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:39 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3078,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:39 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3077,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:39 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-0   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon ID:  0x75b3   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1c4   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3076,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:39 PM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1c4   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
3075,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:39 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-1   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon ID:  0x75c6   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x204   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3074,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:39 PM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x204   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
3073,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:39 PM,4902,None,"The Per-user audit policy table was created.    Number of Elements: 0  Policy ID: 0x7404  "
3072,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:39 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Logon Information:   Logon Type:  0   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  -    New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4   Process Name:  ?    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  -   Authentication Package: -   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3071,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:39 PM,4608,None,"Windows is starting up.    This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.  "
3070,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:39 PM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x254   New Process Name: ??????????????e??? ????????? ???????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1c4   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
3069,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:39 PM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x24c   New Process Name: ????????????????-??6??4????0--?0???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1c4   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
3068,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:39 PM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x204   New Process Name: ????????????????-??6??c????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1bc   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
3067,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:39 PM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1cc   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1bc   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
3066,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:39 PM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1c4   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x16c   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
3065,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:39 PM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1bc   New Process Name: ??????????????-??6??c????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x11c   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
3064,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:39 PM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x174   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x16c   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
3063,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:39 PM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x16c   New Process Name: ??????????????-??6??c????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x11c   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
3062,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:36 PM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x130   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x11c   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
3061,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:36 PM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x11c   New Process Name: ??????????????-??6?4????0--?0???????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x4   Creator Process Name: ???????   Process Command Line: ????0--?0???????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
3060,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:36 PM,4826,None,"Boot Configuration Data loaded.    Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    General Settings:   Load Options:  -   Advanced Options:  No     Configuration Access Policy: Default     System Event Logging: No     Kernel Debugging: No     VSM Launch Type: Off      Signature Settings:   Test Signing:  No     Flight Signing:  No     Disable Integrity Checks: No      HyperVisor Settings:   HyperVisor Load Options: -   HyperVisor Launch Type: Off     HyperVisor Debugging: No    "
3059,Security,Microsoft-Windows-Eventlog,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:17 PM,1100,None,"The event logging service has shut down.  "
3058,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:47:08 PM,4647,None,"User initiated logoff:    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x3c9a3    This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.  "
3057,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:44:20 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3056,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:44:20 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3055,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:42:44 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3054,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:42:44 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3053,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:42:39 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3052,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:42:39 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3051,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:41:22 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3050,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:41:22 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3049,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:40:04 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3048,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:40:04 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3047,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:39:22 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3046,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:39:22 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3045,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:39:08 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3044,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:39:08 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3043,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:39:08 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3042,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:39:08 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3041,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:39:06 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3040,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:39:06 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3039,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:39:03 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-546   Group Name:  Guests   Group Domain:  Builtin    Process Information:   Process ID:  0x1f30   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
3038,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:39:03 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-545   Group Name:  Users   Group Domain:  Builtin    Process Information:   Process ID:  0x1f30   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
3037,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:39:03 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x1f30   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
3036,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:39:03 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-504   Account Name:  WDAGUtilityAccount   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1f30   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
3035,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:39:03 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1f30   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
3034,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:39:03 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1002   Account Name:  sshd   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1f30   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
3033,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:39:03 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1f30   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
3032,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:39:03 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-501   Account Name:  Guest   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1f30   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
3031,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:39:03 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-503   Account Name:  DefaultAccount   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1f30   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
3030,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:39:03 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-500   Account Name:  Administrator   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1f30   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
3029,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:39:02 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3028,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:39:02 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3027,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:38:58 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-501   Account Name:  Guest   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x548   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
3026,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:38:56 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3025,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:38:56 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3024,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:38:55 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3023,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:38:55 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3022,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:38:37 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3021,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:38:37 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3020,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:38:09 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3019,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:38:09 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3018,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:37:33 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3017,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:37:33 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3016,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:37:10 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x3c9a3    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: WDAGUtilityAccount   Target Account Domain: MSEDGEWIN10  "
3015,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:37:10 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x3c9a3    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: sshd_server   Target Account Domain: MSEDGEWIN10  "
3014,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:37:10 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x3c9a3    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: sshd   Target Account Domain: MSEDGEWIN10  "
3013,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:37:10 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x3c9a3    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Guest   Target Account Domain: MSEDGEWIN10  "
3012,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:37:10 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x3c9a3    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: DefaultAccount   Target Account Domain: MSEDGEWIN10  "
3011,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:37:10 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x3c9a3    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Administrator   Target Account Domain: MSEDGEWIN10  "
3010,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:36:17 PM,4634,None,"An account was logged off.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xb5e0b3    Logon Type:   2    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.  "
3009,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:36:17 PM,4634,None,"An account was logged off.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xb5e0d1    Logon Type:   2    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.  "
3008,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:36:17 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xb5e0b3    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3007,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:36:17 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xb5e0d1   Linked Logon ID:  0xb5e0b3   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x5a0   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3006,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:36:17 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xb5e0b3   Linked Logon ID:  0xb5e0d1   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x5a0   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3005,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:36:17 PM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x5a0   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
3004,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:35:58 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3003,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/19/2017 3:35:58 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
3002,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 5:26:54 AM,4616,None,"The system time was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Process Information:   Process ID: 0x9bc   Name:  C:\Program Files\VMware\VMware Tools\vmtoolsd.exe    Previous Time:  2017-12-06T11:23:23.370691100Z  New Time:  2017-12-06T13:26:54.991000000Z    This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.  "
3001,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:13:00 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
3000,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:13:00 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2999,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:13:00 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2998,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:13:00 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2997,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:12:55 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2996,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:12:55 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2995,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:07:23 AM,4616,None,"The system time was changed.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Process Information:   Process ID: 0x13d4   Name:  C:\Windows\System32\svchost.exe    Previous Time:  2017-12-06T11:07:23.056197900Z  New Time:  2017-12-06T11:07:23.056011300Z    This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.  "
2994,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:07:11 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2993,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:07:11 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2992,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:07:10 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2991,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:07:10 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2990,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:07:05 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x19f8   Process Name:  C:\Windows\System32\VSSVC.exe  "
2989,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:07:05 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x19f8   Process Name:  C:\Windows\System32\VSSVC.exe  "
2988,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:07:05 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x19f8   Process Name:  C:\Windows\System32\VSSVC.exe  "
2987,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:07:05 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x19f8   Process Name:  C:\Windows\System32\VSSVC.exe  "
2986,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:07:05 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x19f8   Process Name:  C:\Windows\System32\VSSVC.exe  "
2985,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:07:05 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x19f8   Process Name:  C:\Windows\System32\VSSVC.exe  "
2984,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:07:05 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2983,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:07:05 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2982,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:07:05 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2981,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:07:05 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2980,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:07:05 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x19f8   Process Name:  C:\Windows\System32\VSSVC.exe  "
2979,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:07:05 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x19f8   Process Name:  C:\Windows\System32\VSSVC.exe  "
2978,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:07:05 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2977,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:07:05 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2976,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:01:37 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2975,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:01:37 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2974,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:00:38 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-501   Account Name:  Guest   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xf48   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
2973,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:00:20 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2972,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 3:00:20 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2971,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 2:59:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2970,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 2:59:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2969,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 2:59:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2968,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 2:59:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2967,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 2:59:39 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2966,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 2:59:39 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2965,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 2:59:37 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2964,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 2:59:37 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2963,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 2:59:34 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2962,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 2:59:34 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2961,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 2:59:34 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-501   Account Name:  Guest   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xddc   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
2960,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 2:59:33 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2959,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 2:59:33 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2958,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 2:59:31 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2957,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 2:59:31 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2956,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 2:56:40 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2955,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/6/2017 2:56:40 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2954,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:52:42 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x19a0   Process Name:  C:\Windows\System32\LogonUI.exe  "
2953,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:26:50 AM,4616,None,"The system time was changed.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Process Information:   Process ID: 0xc40   Name:  C:\Windows\System32\svchost.exe    Previous Time:  2017-12-04T10:26:50.051225500Z  New Time:  2017-12-04T10:26:50.051199000Z    This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.  "
2952,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:26:50 AM,4616,None,"The system time was changed.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Process Information:   Process ID: 0xc40   Name:  C:\Windows\System32\svchost.exe    Previous Time:  2017-12-04T10:26:50.047680800Z  New Time:  2017-12-04T10:26:50.047653400Z    This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.  "
2951,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:26:50 AM,4616,None,"The system time was changed.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Process Information:   Process ID: 0xc40   Name:  C:\Windows\System32\svchost.exe    Previous Time:  2017-12-04T10:26:45.400345200Z  New Time:  2017-12-04T10:26:50.043517700Z    This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.  "
2950,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:26:34 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2949,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:26:34 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2948,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:26:33 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2947,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:26:33 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2946,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:26:29 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2945,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:26:29 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2944,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:26:28 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x7fc   Process Name:  C:\Windows\System32\VSSVC.exe  "
2943,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:26:28 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x7fc   Process Name:  C:\Windows\System32\VSSVC.exe  "
2942,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:26:28 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x7fc   Process Name:  C:\Windows\System32\VSSVC.exe  "
2941,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:26:28 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x7fc   Process Name:  C:\Windows\System32\VSSVC.exe  "
2940,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:26:28 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x7fc   Process Name:  C:\Windows\System32\VSSVC.exe  "
2939,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:26:28 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x7fc   Process Name:  C:\Windows\System32\VSSVC.exe  "
2938,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:26:28 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2937,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:26:28 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2936,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:26:28 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x7fc   Process Name:  C:\Windows\System32\VSSVC.exe  "
2935,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:26:28 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x7fc   Process Name:  C:\Windows\System32\VSSVC.exe  "
2934,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:26:28 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2933,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:26:28 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2932,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:26:27 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2931,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:26:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2930,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:22:10 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2929,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:22:10 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2928,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:19:22 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2927,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:19:22 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2926,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:16:42 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2925,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 2:16:42 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2924,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:40:31 AM,4634,None,"An account was logged off.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x6cb94a    Logon Type:   2    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.  "
2923,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:40:31 AM,4634,None,"An account was logged off.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x6cb969    Logon Type:   2    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.  "
2922,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:40:31 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x6cb94a    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2921,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:40:31 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x6cb969   Linked Logon ID:  0x6cb94a   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x5a0   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2920,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:40:31 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x6cb94a   Linked Logon ID:  0x6cb969   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x5a0   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2919,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:40:31 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x5a0   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
2918,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:15:57 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2917,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:15:57 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2916,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:15:45 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2915,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:15:45 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2914,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:15:35 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2913,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:15:35 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2912,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:15:34 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2911,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:15:34 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2910,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:15:32 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2909,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:15:32 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2908,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:15:31 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2907,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:15:31 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2906,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:15:31 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-501   Account Name:  Guest   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x994   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
2905,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:15:30 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2904,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:15:30 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2903,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:15:27 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2902,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:15:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2901,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:12:39 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2900,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:12:39 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2899,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:12:33 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2898,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/4/2017 1:12:33 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2897,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 7:20:04 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xc20   Process Name:  C:\Windows\System32\LogonUI.exe  "
2896,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:41:36 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2895,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:41:36 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2894,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:29:08 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2893,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:29:08 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2892,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:28:58 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2891,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:28:58 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2890,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:28:58 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2889,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:28:58 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2888,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:24:01 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x3c9a3    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: WDAGUtilityAccount   Target Account Domain: MSEDGEWIN10  "
2887,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:24:01 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x3c9a3    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: sshd_server   Target Account Domain: MSEDGEWIN10  "
2886,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:24:01 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x3c9a3    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: sshd   Target Account Domain: MSEDGEWIN10  "
2885,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:24:01 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x3c9a3    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Guest   Target Account Domain: MSEDGEWIN10  "
2884,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:24:01 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x3c9a3    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: DefaultAccount   Target Account Domain: MSEDGEWIN10  "
2883,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:24:01 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x3c9a3    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Administrator   Target Account Domain: MSEDGEWIN10  "
2882,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:05:57 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2881,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:05:57 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2880,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:05:54 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x1134   Process Name:  C:\Windows\System32\svchost.exe  "
2879,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:05:54 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x1134   Process Name:  C:\Windows\System32\svchost.exe  "
2878,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:05:53 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2877,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:05:53 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2876,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:05:13 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2875,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:05:13 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2874,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:05:00 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2873,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:05:00 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2872,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:04:59 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2871,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:04:59 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2870,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:04:51 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2869,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:04:51 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2868,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:04:49 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2867,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:04:49 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2866,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:04:49 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2865,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:04:49 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2864,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:04:23 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2863,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:04:23 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2862,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:03:54 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2861,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:03:54 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2860,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:03:20 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2859,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:03:20 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2858,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:01:17 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2857,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:01:17 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2856,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:00:58 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2855,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:00:58 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2854,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:00:31 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2853,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:00:31 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2852,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:00:31 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2851,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 6:00:31 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2850,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 5:58:41 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2849,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 5:58:41 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2848,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 5:58:41 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2847,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 5:58:41 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2846,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 5:58:31 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2845,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 5:58:31 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2844,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 5:58:27 PM,4634,None,"An account was logged off.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x37e8ba    Logon Type:   2    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.  "
2843,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 5:58:27 PM,4634,None,"An account was logged off.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x37e8d8    Logon Type:   2    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.  "
2842,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 5:58:27 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x37e8ba    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2841,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 5:58:27 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x37e8d8   Linked Logon ID:  0x37e8ba   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x5a0   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2840,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 5:58:27 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x37e8ba   Linked Logon ID:  0x37e8d8   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x5a0   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2839,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 5:58:27 PM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x5a0   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
2838,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 5:30:59 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2837,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 5:30:59 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2836,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 5:30:55 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-501   Account Name:  Guest   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1a48   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
2835,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 5:30:55 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2834,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 5:30:55 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2833,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 5:30:54 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x12b8   Process Name:  C:\Windows\System32\svchost.exe  "
2832,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 5:30:54 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x12b8   Process Name:  C:\Windows\System32\svchost.exe  "
2831,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 5:30:53 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2830,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 5:30:53 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2829,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 5:30:53 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2828,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 5:30:53 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2827,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 5:27:57 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2826,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 5:27:57 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2825,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 5:27:53 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xae4   Process Name:  C:\Windows\System32\LogonUI.exe  "
2824,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 3:06:06 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2823,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 3:06:06 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2822,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:40:06 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2821,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:40:06 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2820,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:40:06 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2819,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:40:06 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2818,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:33:58 AM,4634,None,"An account was logged off.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x20c49a    Logon Type:   2    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.  "
2817,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:33:58 AM,4634,None,"An account was logged off.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x20c4b7    Logon Type:   2    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.  "
2816,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:33:58 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x20c49a    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2815,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:33:58 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x20c4b7   Linked Logon ID:  0x20c49a   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x5a0   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2814,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:33:58 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x20c49a   Linked Logon ID:  0x20c4b7   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x5a0   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2813,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:33:58 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x5a0   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
2812,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:33:52 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2811,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:33:52 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2810,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:28:54 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2809,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:28:54 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2808,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:28:18 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2807,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:28:18 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2806,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:26:51 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2805,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:26:51 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2804,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:26:48 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2803,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:26:48 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2802,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:26:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2801,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:26:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2800,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:26:19 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2799,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:26:19 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2798,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:26:18 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2797,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:26:18 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2796,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:25:48 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2795,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:25:48 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2794,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:25:36 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-501   Account Name:  Guest   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x550   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
2793,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:24:28 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2792,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:24:28 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2791,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:24:21 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x1d90   Process Name:  C:\Windows\System32\svchost.exe  "
2790,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:24:21 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x1d90   Process Name:  C:\Windows\System32\svchost.exe  "
2789,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:24:21 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2788,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:24:21 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2787,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:24:19 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2786,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:24:19 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2785,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:24:05 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2784,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:24:05 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2783,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:24:01 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x1068   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
2782,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:24:01 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x1068   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
2781,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:24:00 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2780,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:24:00 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2779,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:24:00 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2778,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:24:00 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2777,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:58 AM,5059,None,"Key migration operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Additional Information:   Operation: Export of persistent cryptographic key.     Return Code: 0x0  "
2776,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:58 AM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
2775,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:58 AM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Key File Operation Information:   File Path: C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
2774,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:57 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2773,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:57 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2772,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:57 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2771,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:57 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2770,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:57 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2769,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:57 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2768,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:54 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x3b8   Process Name:  C:\Windows\System32\LogonUI.exe  "
2767,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:53 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2766,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:53 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2765,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:52 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x4b4   Process Name:  C:\Windows\System32\svchost.exe  "
2764,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:52 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x3c777    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2763,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:52 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x3c9a3   Linked Logon ID:  0x3c777   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x5a0   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2762,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:52 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x3c777   Linked Logon ID:  0x3c9a3   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x5a0   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2761,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:52 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x5a0   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
2760,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:51 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2759,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:51 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2758,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x794   Process Name:  C:\Windows\System32\VSSVC.exe  "
2757,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x794   Process Name:  C:\Windows\System32\VSSVC.exe  "
2756,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x794   Process Name:  C:\Windows\System32\VSSVC.exe  "
2755,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x794   Process Name:  C:\Windows\System32\VSSVC.exe  "
2754,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:48 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x794   Process Name:  C:\Windows\System32\VSSVC.exe  "
2753,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:48 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x794   Process Name:  C:\Windows\System32\VSSVC.exe  "
2752,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:48 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2751,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:48 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2750,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:48 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x794   Process Name:  C:\Windows\System32\VSSVC.exe  "
2749,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:48 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x794   Process Name:  C:\Windows\System32\VSSVC.exe  "
2748,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:48 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2747,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:48 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2746,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:46 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x16a43    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xef4   Process Name:  C:\Program Files\OpenSSH\bin\cygrunsrv.exe  "
2745,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:46 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x4b4   Process Name:  C:\Windows\System32\svchost.exe  "
2744,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:45 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2743,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:45 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2742,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:44 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2741,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:44 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2740,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:43 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x94c   Process Name:  C:\Windows\System32\svchost.exe  "
2739,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:43 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x94c   Process Name:  C:\Windows\System32\svchost.exe  "
2738,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:43 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2737,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:43 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2736,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:42 AM,5024,None,"The Windows Firewall service started successfully.  "
2735,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:42 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x930   Process Name:  C:\Windows\System32\svchost.exe  "
2734,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:42 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x930   Process Name:  C:\Windows\System32\svchost.exe  "
2733,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:42 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2732,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:42 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2731,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2730,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2729,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2728,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2727,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2726,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2725,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2724,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2723,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2722,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2721,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2720,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2719,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2718,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2717,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x16a43    Privileges:  SeCreateTokenPrivilege     SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2716,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x16a43   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2715,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:41 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
2714,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2713,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2712,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2711,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2710,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:40 AM,5033,None,"The Windows Firewall Driver started successfully.  "
2709,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:40 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2708,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:40 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2707,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:40 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2706,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:40 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2705,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:40 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2704,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:40 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2703,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:39 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2702,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:39 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2701,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:39 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2700,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:39 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2699,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:39 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2698,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:39 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2697,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:39 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2696,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:39 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2695,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:39 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2694,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:39 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2693,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:39 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2692,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:39 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2691,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:39 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
2690,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:39 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2689,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:39 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbb1d    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege  "
2688,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:39 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbaf0    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
2687,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:39 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbb1d   Linked Logon ID:  0xbaf0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x208   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2686,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:39 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbaf0   Linked Logon ID:  0xbb1d   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x208   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2685,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:39 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  DWM-1   Account Domain:  Window Manager   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x208   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
2684,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:38 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2683,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:38 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2682,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:38 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
2681,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:38 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2680,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:38 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2679,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:38 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2678,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:38 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2677,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:38 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x24c   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2676,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:38 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-0   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon ID:  0x7529   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1c4   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2675,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:38 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1c4   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
2674,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:38 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-1   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon ID:  0x7538   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x208   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2673,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:38 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x208   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
2672,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:38 AM,4902,None,"The Per-user audit policy table was created.    Number of Elements: 0  Policy ID: 0x7382  "
2671,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:38 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Logon Information:   Logon Type:  0   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  -    New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4   Process Name:  ?    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  -   Authentication Package: -   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2670,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:38 AM,4608,None,"Windows is starting up.    This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.  "
2669,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:38 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x254   New Process Name: ??????????????e??? ????????? ???????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1c4   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
2668,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:38 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x24c   New Process Name: ????????????????-??6??4????0--?0???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1c4   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
2667,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:38 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x208   New Process Name: ????????????????-??6??c????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1bc   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
2666,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:38 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1cc   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1bc   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
2665,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:38 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1c4   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x16c   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
2664,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:38 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1bc   New Process Name: ??????????????-??6??c????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x11c   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
2663,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:38 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x174   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x16c   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
2662,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:37 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x16c   New Process Name: ??????????????-??6??c????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x11c   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
2661,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:35 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x130   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x11c   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
2660,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:35 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x11c   New Process Name: ??????????????-??6?4????0--?0???????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x4   Creator Process Name: ???????   Process Command Line: ????0--?0???????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
2659,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:35 AM,4826,None,"Boot Configuration Data loaded.    Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    General Settings:   Load Options:  -   Advanced Options:  No     Configuration Access Policy: Default     System Event Logging: No     Kernel Debugging: No     VSM Launch Type: Off      Signature Settings:   Test Signing:  No     Flight Signing:  No     Disable Integrity Checks: No      HyperVisor Settings:   HyperVisor Load Options: -   HyperVisor Launch Type: Off     HyperVisor Debugging: No    "
2658,Security,Microsoft-Windows-Eventlog,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:23:12 AM,1100,None,"The event logging service has shut down.  "
2657,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:39 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\TextInput\WindowsInternal.ComposableShell.Experiences.TextInput.LayoutData.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2656,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:39 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\TextInput\WindowsInternal.ComposableShell.Experiences.TextInput.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2655,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:39 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Speech_OneCore\Engines\SR\spsreng_onecore.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2654,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:39 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Speech_OneCore\common\sapi_onecore.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2653,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:39 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\F12\F12Script2.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2652,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:39 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Dism\FfuProvider.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2651,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:39 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\wmp.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2650,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:39 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Windows.UI.Input.Inking.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2649,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:39 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Windows.Perception.Stub.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2648,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:39 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Windows.Mirage.Internal.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2647,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:39 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Windows.Mirage.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2646,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:39 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Windows.Media.Speech.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2645,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:39 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Windows.Media.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2644,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:39 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\win32kfull.sys   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2643,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:39 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\vbscript.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2642,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:39 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\user32.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2641,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:39 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\tzres.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2640,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:39 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\TileDataRepository.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2639,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\rdrleakdiag.exe   Handle ID: 0x9c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2638,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\PCPKsp.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2637,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\mshtml.dll   Handle ID: 0x9c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2636,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\msexcl40.dll   Handle ID: 0x9c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2635,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\msdtcVSp1res.dll   Handle ID: 0x9c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2634,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\mispace.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2633,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\mfsrcsnk.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2632,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\mfmpeg2srcsnk.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2631,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\mfmp4srcsnk.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2630,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\mfcore.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2629,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\mfasfsrcsnk.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2628,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\jscript9.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2627,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\jscript.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2626,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\edgehtml.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2625,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\dwmcore.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2624,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\d3d10warp.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2623,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\CloudExperienceHostCommon.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2622,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Chakradiag.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2621,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Chakra.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2620,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\CapabilityAccessManagerClient.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2619,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\AudioSes.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2618,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\AudioEng.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2617,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\AcSpecfc.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2616,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\AcLayers.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2615,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\AcGenral.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2614,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemResources\TextInput\TextInput.pri   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2613,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\resources.pri   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2612,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\MixedRealityPortal.exe   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2611,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\MixedRealityPortal.Brokered.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2610,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\AppxSignature.p7x   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2609,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\AppxManifest.xml   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2608,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\AppxBlockMap.xml   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2607,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\InputApp_cw5n1h2txyewy\resources.pri   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2606,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\WinBioPlugIns\FaceRecognitionSensorAdapterVsm.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2605,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\WinBioPlugIns\FaceRecognitionSensorAdapter.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2604,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\WinBioPlugIns\FaceRecognitionEngineAdapter.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2603,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Speech_OneCore\Engines\SR\spsreng_onecore.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2602,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Speech_OneCore\common\sapi_onecore.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2601,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\migration\TileStoreMigrationPlugin.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2600,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\F12\F12Script2.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2599,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\en-US\tzres.dll.mui   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2598,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\UMDF\UcmCx.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2597,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\wcifs.sys   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2596,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\UcmCx.sys   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2595,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Dism\FfuProvider.dll   Handle ID: 0x88    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2594,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\appraiser\appraiser.sdb   Handle ID: 0x88    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2593,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\wuuhext.dll   Handle ID: 0x88    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2592,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\wuaueng.dll   Handle ID: 0x88    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2591,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\wow64win.dll   Handle ID: 0x88    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2590,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\wmp.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2589,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Windows.UI.Input.Inking.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2588,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Windows.Perception.Stub.dll   Handle ID: 0x9c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2587,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Windows.Mirage.Internal.dll   Handle ID: 0x9c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2586,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Windows.Mirage.dll   Handle ID: 0x9c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2585,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Windows.Media.Speech.dll   Handle ID: 0x9c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2584,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Windows.Media.dll   Handle ID: 0x9c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2583,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\win32kfull.sys   Handle ID: 0x9c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2582,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\win32kbase.sys   Handle ID: 0x9c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2581,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\vbscript.dll   Handle ID: 0x9c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2580,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\vac.exe   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2579,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\user32.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2578,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\tzres.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2577,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\twinui.pcshell.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2576,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\TileDataRepository.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2575,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Spectrum.exe   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2574,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\SettingsHandlers_CapabilityAccess.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2573,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\runexehelper.exe   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2572,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\RDXService.dll   Handle ID: 0x9c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2571,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\rdrleakdiag.exe   Handle ID: 0x9c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2570,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\PCPKsp.dll   Handle ID: 0x9c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2569,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\mshtml.dll   Handle ID: 0x9c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2568,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\msdtcVSp1res.dll   Handle ID: 0x9c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2567,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\mispace.dll   Handle ID: 0x9c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2566,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\mfsrcsnk.dll   Handle ID: 0x9c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2565,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\mfmpeg2srcsnk.dll   Handle ID: 0x9c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2564,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\mfmp4srcsnk.dll   Handle ID: 0x9c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2563,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\mfcore.dll   Handle ID: 0x9c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2562,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\mfasfsrcsnk.dll   Handle ID: 0x9c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2561,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\jscript9diag.dll   Handle ID: 0xa4    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2560,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\jscript9.dll   Handle ID: 0xa4    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2559,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\jscript.dll   Handle ID: 0xa4    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2558,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ISM.dll   Handle ID: 0x9c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2557,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Hydrogen.dll   Handle ID: 0xa4    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2556,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\HolographicRuntimes.dll   Handle ID: 0x9c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2555,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\HolographicExtensions.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2554,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\HologramCompositor.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2553,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\FaceProcessorCore.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2552,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\FaceProcessor.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2551,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\edgehtml.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2550,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\dwmcore.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2549,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\diagtrack.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2548,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\DHolographicDisplay.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2547,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\devinv.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2546,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\d3d10warp.dll   Handle ID: 0xa4    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2545,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\CloudExperienceHostCommon.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2544,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Chakradiag.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2543,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Chakra.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2542,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\CapabilityAccessManagerClient.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2541,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\CapabilityAccessManager.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2540,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\BioIso.exe   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2539,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\audiosrv.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2538,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\AudioSes.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2537,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\AudioEng.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2536,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\AudioEndpointBuilder.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2535,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\audiodg.exe   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2534,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\aeinv.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2533,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\AcSpecfc.dll   Handle ID: 0x9c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2532,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\AcLayers.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2531,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\AcGenral.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2530,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\en-US\PresentationHost_v0400.dll.mui   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2529,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\wpfgfx_v0400.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2528,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WindowsBase.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2527,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\UIAutomationTypes.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2526,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\UIAutomationProvider.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2525,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\UIAutomationClientsideProviders.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2524,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\UIAutomationClient.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2523,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\System.Windows.Controls.Ribbon.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2522,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationNative_v0400.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2521,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationHost_v0400.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2520,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2519,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationCore.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2518,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PenIMC_v0400.dll   Handle ID: 0x98    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2517,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PenIMC2_v0400.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2516,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PenIMC.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2515,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\NativeImages\mscorlib.ni.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2514,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xaml.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2513,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2512,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SOS.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2511,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\peverify.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2510,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2509,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscordbi.dll   Handle ID: 0x94    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2508,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscordacwks.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2507,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\compatjit.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2506,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2505,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll   Handle ID: 0x90    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2504,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\en-US\PresentationHost_v0400.dll.mui   Handle ID: 0x8c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2503,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll   Handle ID: 0x8c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2502,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WindowsBase.dll   Handle ID: 0x8c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2501,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\UIAutomationTypes.dll   Handle ID: 0x8c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2500,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\UIAutomationProvider.dll   Handle ID: 0x88    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2499,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\UIAutomationClientsideProviders.dll   Handle ID: 0x88    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2498,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\UIAutomationClient.dll   Handle ID: 0x88    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2497,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\System.Windows.Controls.Ribbon.dll   Handle ID: 0x88    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2496,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll   Handle ID: 0x88    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2495,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationHost_v0400.dll   Handle ID: 0x88    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2494,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationFramework.dll   Handle ID: 0x84    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2493,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationCore.dll   Handle ID: 0x84    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2492,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\PenIMC_v0400.dll   Handle ID: 0x84    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2491,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\PenIMC2_v0400.dll   Handle ID: 0x88    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2490,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\PenIMC.dll   Handle ID: 0x84    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2489,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\NativeImages\mscorlib.ni.dll   Handle ID: 0x84    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2488,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Xaml.dll   Handle ID: 0x80    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2487,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Core.dll   Handle ID: 0x80    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2486,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\SOS.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2485,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\peverify.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2484,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll   Handle ID: 0x80    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2483,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscordbi.dll   Handle ID: 0x80    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2482,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscordacwks.dll   Handle ID: 0x80    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2481,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll   Handle ID: 0x80    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2480,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll   Handle ID: 0x80    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2479,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim   Handle ID: 0x80    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2478,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\apppatch\sysmain.sdb   Handle ID: 0x80    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2477,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\apppatch\msimain.sdb   Handle ID: 0x7c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2476,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\apppatch\drvmain.sdb   Handle ID: 0x80    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2475,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll   Handle ID: 0x80    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2474,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:38 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe   Handle ID: 0x7c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2473,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\program_files_common_files_microsoft_shared_ink_3c86e3db0b3b254c.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2472,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\program_files_common_files_microsoft_shared_818c5a0e45020fba.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2471,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\program_files_common_files_d7a65bb2f0e854e7.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2470,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\program_files_windows_media_player_media_renderer_5001a1a5de706f6e.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2469,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\program_files_windows_media_player_network_sharing_aed05552f451fd7d.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2468,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\program_files_windows_media_player_da4e5f6eb3198de9.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2467,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\program_files_ffd0cbfc813cc4f1.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2466,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\program_files_x86_windows_media_player_media_renderer_750773e49fdbfa5b.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2465,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\program_files_x86_windows_media_player_network_sharing_f29a3dd721834a7e.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2464,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\program_files_x86_windows_media_player_e9607c93dd43c2ea.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2463,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\program_files_x86__676bbe2c7241b694.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2462,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_diagnosis_asimovuploader_0413bca0c3dfdda4.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2461,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_diagnosis_customtraceprofiles_90d388772cf90ca3.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2460,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_diagnosis_downloadedscenarios_995fa01e94b9ae39.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2459,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_diagnosis_downloadedsettings_f4a4d355cda0ca19.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2458,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_diagnosis_etllogs_autologger_91adf7c94bd2d1fa.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2457,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_diagnosis_etllogs_scenarioshutdownlogger_f2836e137ebe0975.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2456,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_diagnosis_etllogs_shutdownlogger_5ca7b57d60632f51.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2455,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_diagnosis_etllogs_ffc0f561f3797ceb.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2454,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_diagnosis_eventtranscript_e5c902fe71986f37.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2453,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_diagnosis_localtracestore_b69b398684e58a86.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2452,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_diagnosis_offlinesettings_3d82d09728c650a9.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2451,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_diagnosis_scripts_1ccc196fc5f94e61.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2450,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_diagnosis_sideload_1bd7d65b4945242a.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2449,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_diagnosis_softlanding_4cba8d6220265950.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2448,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_diagnosis_softlandingstage_70419bf36c6a48e6.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2447,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_diagnosis_tenantstorage_1bbb9d3dba9fb526.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2446,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_diagnosis_windowsanalytics_426faf4e30e982be.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2445,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_diagnosis_af2ddc54e6a8e491.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2444,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_spectrum_1dcb4f178cfd5701.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2443,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_speech_onecore_587c58cfbeda0062.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2442,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_retaildemo_offlinecontent_microsoft_content_neutral_fb28470e79dbd425.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2441,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_retaildemo_offlinecontent_microsoft_content_e8db5309f86131b4.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2440,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_retaildemo_offlinecontent_microsoft_53a3137a3de96b65.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2439,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_retaildemo_offlinecontent_packages_bfcdebcc9ac9ef74.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2438,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_retaildemo_offlinecontent_287c1f66975af721.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2437,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_retaildemo_235295a6167f1c31.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2436,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_cae2264614449191.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2435,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_fe5c6d762edd2110.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2434,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_softwaredistribution_ae0bdc9bb1bbdfab.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2433,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_windowsholographicdevices_spatialstore_d5a1eb12b1c88209.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2432,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_windowsholographicdevices_da35b7d83993eebe.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2431,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2430,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_apppatch_1143992cbbbebcab.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2429,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_containers_serviced_07c9b2b35f82b615.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2428,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_globalization_time_zone_08f498d155d3913e.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2427,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_globalization_0fc22903a221b67f.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2426,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_microsoft.net_framework_v4.0.30319_nativeimages_7f83bd6ed8241f3a.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2425,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_microsoft.net_framework_v4.0.30319_wpf_en-us_dc5fd125966afabc.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2424,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_microsoft.net_framework_v4.0.30319_wpf_bc1339ef8efa3c4c.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2423,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_microsoft.net_framework_v4.0.30319_c40c7a995ddd757b.cdf-ms   Handle ID: 0x68    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2422,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_microsoft.net_framework_83386eac0379231b.cdf-ms   Handle ID: 0x68    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2421,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_microsoft.net_framework64_v4.0.30319_nativeimages_ae465c5139d1dacc.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2420,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_microsoft.net_framework64_v4.0.30319_wpf_en-us_0242687c673a608c.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2419,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_microsoft.net_framework64_v4.0.30319_wpf_647a02df72a14032.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2418,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_microsoft.net_framework64_v4.0.30319_46321ba736a30085.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2417,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_microsoft.net_framework64_083d4e330e766c5d.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2416,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_microsoft.net_3296b36dbe4c7fa3.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2415,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_registration_crmlog_465e30d81bd737eb.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2414,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_registration_26fbb5fa22d64b83.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2413,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system_speech_00e1f005eaf69ef5.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2412,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system_4c3aa2308f9f8f41.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2411,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_appraiser_59bebec9f06db09b.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2410,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_codeintegrity_e9af9308cfc26dc2.cdf-ms   Handle ID: 0x68    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2409,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_com_dmp_daa91bde29785e3e.cdf-ms   Handle ID: 0x68    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2408,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_com_066545e3d047e7c7.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2407,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_dism_066548addf2fbd4b.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2406,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_drivers_umdf_a531b5dc588477d3.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2405,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_drivers_dc1b782427b5ee1b.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2404,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_en-us_429cd25484dc6f94.cdf-ms   Handle ID: 0x68    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2403,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_f12_06654f97d047d6b1.cdf-ms   Handle ID: 0x68    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2402,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_migration_927a21df1acd7c18.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2401,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_speech_onecore_common_60bf750299e8ab15.cdf-ms   Handle ID: 0x68    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2400,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_speech_onecore_engines_sr_44c0fa140b306d00.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2399,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_speech_onecore_voiceactivation_57f72a0344e2d398.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2398,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_winbioplugins_071a28c5b510fb6a.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2397,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2396,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_inputapp_cw5n1h2txyewy_assets_fonts_e8459e44c2b9b728.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2395,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_inputapp_cw5n1h2txyewy_assets_154aa123a347aa26.cdf-ms   Handle ID: 0x68    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2394,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_inputapp_cw5n1h2txyewy_9df2da13dd3956d1.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2393,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.holographicfirstrun_cw5n1h2txyewy_assets_fa2d54e2d81dc483.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2392,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.holographicfirstrun_cw5n1h2txyewy_pris_960a16f2012eced2.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2391,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.holographicfirstrun_cw5n1h2txyewy_dabe890a6e455bec.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2390,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_textinput_pris_c0bd418e6ad3668b.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2389,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_textinput_7145b1667a9c024f.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2388,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.data.timezones_pris_4fe1d707bdf60b69.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2387,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.data.timezones_d6ed24e35548e087.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2386,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_0307ca33e1cd9708.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2385,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_com_dmp_17ca08e2af33160a.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2384,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_com_1bf23555a7667cfb.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2383,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_dism_1bf2381fbb30eb13.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2382,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_en-us_9e576ab077991fe8.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2381,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_f12_1bf23f09a7666be5.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2380,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_speech_onecore_common_3ac1627a1b848769.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2379,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_speech_onecore_engines_sr_d9a4a4f7ccdfa5ac.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2378,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_speech_onecore_voiceactivation_64af56b9bf516892.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2377,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_21ffbdd2a2dd92e0.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2376,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_textinput_fb44238906e335d1.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2375,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2374,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\_0000000000000000.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2373,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\ntdll.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2372,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\storport.sys   Handle ID: 0x70    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2371,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\rdbss.sys   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2370,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\ntfs.sys   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2369,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\luafv.sys   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2368,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\dxgkrnl.sys   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2367,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ntoskrnl.exe   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2366,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ntdll.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2365,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:37 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ci.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x2214   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2364,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:35 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x275c   Process Name:  C:\Windows\System32\VSSVC.exe  "
2363,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:35 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x275c   Process Name:  C:\Windows\System32\VSSVC.exe  "
2362,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:35 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x275c   Process Name:  C:\Windows\System32\VSSVC.exe  "
2361,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:35 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x275c   Process Name:  C:\Windows\System32\VSSVC.exe  "
2360,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:35 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x275c   Process Name:  C:\Windows\System32\VSSVC.exe  "
2359,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:35 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x275c   Process Name:  C:\Windows\System32\VSSVC.exe  "
2358,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:35 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x275c   Process Name:  C:\Windows\System32\VSSVC.exe  "
2357,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:35 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x275c   Process Name:  C:\Windows\System32\VSSVC.exe  "
2356,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:35 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2355,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:35 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2354,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:10 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2353,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:10 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2352,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:10 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2351,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:10 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2350,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:10 AM,4647,None,"User initiated logoff:    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x21c534    This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.  "
2349,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:02 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2348,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:22:02 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2347,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:15:06 AM,4616,None,"The system time was changed.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Process Information:   Process ID: 0x20bc   Name:  C:\Windows\System32\svchost.exe    Previous Time:  2017-12-02T10:15:06.523901500Z  New Time:  2017-12-02T10:15:06.523855400Z    This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.  "
2346,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:14:52 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2345,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:14:52 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2344,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:14:51 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2343,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:14:51 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2342,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:14:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x11f8   Process Name:  C:\Windows\System32\VSSVC.exe  "
2341,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:14:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x11f8   Process Name:  C:\Windows\System32\VSSVC.exe  "
2340,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:14:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x11f8   Process Name:  C:\Windows\System32\VSSVC.exe  "
2339,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:14:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x11f8   Process Name:  C:\Windows\System32\VSSVC.exe  "
2338,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:14:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x11f8   Process Name:  C:\Windows\System32\VSSVC.exe  "
2337,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:14:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x11f8   Process Name:  C:\Windows\System32\VSSVC.exe  "
2336,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:14:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2335,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:14:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2334,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:14:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2333,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:14:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2332,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:14:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x11f8   Process Name:  C:\Windows\System32\VSSVC.exe  "
2331,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:14:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x11f8   Process Name:  C:\Windows\System32\VSSVC.exe  "
2330,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:14:48 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2329,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:14:48 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2328,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:14:48 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2327,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:14:48 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2326,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:07:59 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2325,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:07:59 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2324,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:07:41 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2323,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:07:41 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2322,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:07:28 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2321,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:07:28 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2320,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:07:28 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-501   Account Name:  Guest   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x11dc   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
2319,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:07:27 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2318,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:07:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2317,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:07:25 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2316,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:07:25 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2315,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:07:24 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x1fc0   Process Name:  C:\Windows\System32\svchost.exe  "
2314,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:07:24 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x1fc0   Process Name:  C:\Windows\System32\svchost.exe  "
2313,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:07:24 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2312,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:07:24 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2311,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:07:22 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2310,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:07:22 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2309,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:07:21 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2308,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:07:21 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2307,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:04:25 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2306,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,12/2/2017 2:04:25 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2305,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 4:05:27 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x2380   Process Name:  C:\Windows\System32\VSSVC.exe  "
2304,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 4:05:27 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x2380   Process Name:  C:\Windows\System32\VSSVC.exe  "
2303,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 4:05:27 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x2380   Process Name:  C:\Windows\System32\VSSVC.exe  "
2302,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 4:05:27 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x2380   Process Name:  C:\Windows\System32\VSSVC.exe  "
2301,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 4:05:27 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2300,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 4:05:27 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2299,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 4:05:27 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x2380   Process Name:  C:\Windows\System32\VSSVC.exe  "
2298,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 4:05:27 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x2380   Process Name:  C:\Windows\System32\VSSVC.exe  "
2297,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 4:05:27 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x2380   Process Name:  C:\Windows\System32\VSSVC.exe  "
2296,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 4:05:27 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x2380   Process Name:  C:\Windows\System32\VSSVC.exe  "
2295,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 4:05:27 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2294,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 4:05:27 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2293,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:59:51 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2292,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:59:51 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2291,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:59:50 PM,4616,None,"The system time was changed.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Process Information:   Process ID: 0xc2c   Name:  C:\Windows\System32\svchost.exe    Previous Time:  2017-11-30T23:59:50.763818000Z  New Time:  2017-11-30T23:59:50.763796200Z    This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.  "
2290,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:59:50 PM,4616,None,"The system time was changed.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Process Information:   Process ID: 0xc2c   Name:  C:\Windows\System32\svchost.exe    Previous Time:  2017-11-30T23:59:50.760902800Z  New Time:  2017-11-30T23:59:50.760869800Z    This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.  "
2289,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:59:50 PM,4616,None,"The system time was changed.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Process Information:   Process ID: 0xc2c   Name:  C:\Windows\System32\svchost.exe    Previous Time:  2017-11-30T23:59:47.830771000Z  New Time:  2017-11-30T23:59:50.753945500Z    This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.  "
2288,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:59:28 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2287,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:59:28 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2286,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:59:22 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2285,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:59:22 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2284,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:59:17 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2283,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:59:17 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2282,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:59:17 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xef4   Process Name:  C:\Windows\System32\VSSVC.exe  "
2281,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:59:17 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xef4   Process Name:  C:\Windows\System32\VSSVC.exe  "
2280,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:59:17 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xef4   Process Name:  C:\Windows\System32\VSSVC.exe  "
2279,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:59:17 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xef4   Process Name:  C:\Windows\System32\VSSVC.exe  "
2278,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:59:17 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xef4   Process Name:  C:\Windows\System32\VSSVC.exe  "
2277,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:59:17 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xef4   Process Name:  C:\Windows\System32\VSSVC.exe  "
2276,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:59:16 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x21c517    Object:   Object Server: Security   Object Type: File   Object Name: C:\Users\IEUser\AppData\Local\Temp\winre\ExtractedFromWim   Handle ID: 0x7b0    Process Information:   Process ID: 0x22f4   Process Name: C:\Windows\System32\taskhostw.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2275,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:59:16 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2274,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:59:16 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2273,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:59:16 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xef4   Process Name:  C:\Windows\System32\VSSVC.exe  "
2272,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:59:16 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xef4   Process Name:  C:\Windows\System32\VSSVC.exe  "
2271,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:59:16 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2270,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:59:16 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2269,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:59:16 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2268,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:59:16 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2267,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:55:03 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2266,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:55:03 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2265,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:47:19 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1528   Process Name:  C:\Windows\System32\LogonUI.exe  "
2264,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:44:49 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x21c534    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: WDAGUtilityAccount   Target Account Domain: MSEDGEWIN10  "
2263,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:44:49 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x21c534    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: sshd_server   Target Account Domain: MSEDGEWIN10  "
2262,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:44:49 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x21c534    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: sshd   Target Account Domain: MSEDGEWIN10  "
2261,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:44:49 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x21c534    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Guest   Target Account Domain: MSEDGEWIN10  "
2260,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:44:49 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x21c534    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: DefaultAccount   Target Account Domain: MSEDGEWIN10  "
2259,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:44:49 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x21c534    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Administrator   Target Account Domain: MSEDGEWIN10  "
2258,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:39:08 PM,4634,None,"An account was logged off.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x2bad00f    Logon Type:   2    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.  "
2257,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:39:08 PM,4634,None,"An account was logged off.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x2bad02d    Logon Type:   2    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.  "
2256,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:39:08 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x2bad00f    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2255,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:39:08 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x2bad02d   Linked Logon ID:  0x2bad00f   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x758   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2254,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:39:08 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x2bad00f   Linked Logon ID:  0x2bad02d   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x758   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2253,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:39:08 PM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x758   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
2252,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:38:54 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1b08   Process Name:  C:\Windows\System32\LogonUI.exe  "
2251,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:10:52 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2250,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:10:52 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2249,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:10:52 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2248,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:10:52 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2247,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:09:17 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2246,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:09:17 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2245,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:08:33 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2244,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:08:33 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2243,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:07:35 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x8d0   Process Name:  C:\Windows\System32\VSSVC.exe  "
2242,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:07:35 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x8d0   Process Name:  C:\Windows\System32\VSSVC.exe  "
2241,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:07:35 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x8d0   Process Name:  C:\Windows\System32\VSSVC.exe  "
2240,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:07:35 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x8d0   Process Name:  C:\Windows\System32\VSSVC.exe  "
2239,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:07:35 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x8d0   Process Name:  C:\Windows\System32\VSSVC.exe  "
2238,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:07:35 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x8d0   Process Name:  C:\Windows\System32\VSSVC.exe  "
2237,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:07:35 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2236,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:07:35 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2235,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:07:35 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x8d0   Process Name:  C:\Windows\System32\VSSVC.exe  "
2234,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:07:35 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x8d0   Process Name:  C:\Windows\System32\VSSVC.exe  "
2233,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:07:35 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2232,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:07:35 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2231,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:07:35 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Macromed\Flash\FlashUtil_ActiveX.exe   Handle ID: 0x8ec    Process Information:   Process ID: 0xb18   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2230,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:07:35 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Macromed\Flash\FlashUtil_ActiveX.dll   Handle ID: 0xc28    Process Information:   Process ID: 0xb18   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2229,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:07:35 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Macromed\Flash\Flash.ocx   Handle ID: 0xc7c    Process Information:   Process ID: 0xb18   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2228,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:07:35 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Macromed\Flash\activex.vch   Handle ID: 0x290    Process Information:   Process ID: 0xb18   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2227,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:07:35 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe   Handle ID: 0x8ec    Process Information:   Process ID: 0xb18   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2226,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:07:35 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.dll   Handle ID: 0xc20    Process Information:   Process ID: 0xb18   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2225,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:07:35 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Macromed\Flash\Flash.ocx   Handle ID: 0xc28    Process Information:   Process ID: 0xb18   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2224,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:07:35 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Macromed\Flash\activex.vch   Handle ID: 0xc7c    Process Information:   Process ID: 0xb18   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
2223,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:07:35 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_macromed_flash_5ff3bc7496f0271e.cdf-ms   Handle ID: 0xbac    Process Information:   Process ID: 0xb18   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2222,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:07:35 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms   Handle ID: 0xc28    Process Information:   Process ID: 0xb18   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2221,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:07:35 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_macromed_flash_853cbcf10f17f618.cdf-ms   Handle ID: 0xc7c    Process Information:   Process ID: 0xb18   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2220,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:07:35 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_21ffbdd2a2dd92e0.cdf-ms   Handle ID: 0xc20    Process Information:   Process ID: 0xb18   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2219,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:07:35 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$.cdf-ms   Handle ID: 0x8ec    Process Information:   Process ID: 0xb18   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2218,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:07:35 PM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\_0000000000000000.cdf-ms   Handle ID: 0xc78    Process Information:   Process ID: 0xb18   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
2217,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:06:39 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2216,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:06:39 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2215,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:06:38 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2214,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:06:38 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2213,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:06:03 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2212,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:06:03 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2211,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:06:00 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2210,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:06:00 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2209,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:05:17 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2208,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:05:17 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2207,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:04:09 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2206,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:04:09 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2205,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:04:05 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2204,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:04:05 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2203,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:02:43 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2202,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:02:43 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2201,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:02:10 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2200,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:02:10 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2199,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:00:42 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2198,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:00:42 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2197,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:00:37 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2196,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 3:00:37 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2195,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:59:37 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2194,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:59:37 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2193,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:59:30 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2192,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:59:30 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2191,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:57:32 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2190,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:57:32 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2189,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:56:54 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2188,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:56:54 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2187,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:56:53 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2186,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:56:53 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2185,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:56:11 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x26b4   Process Name:  C:\Windows\System32\svchost.exe  "
2184,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:56:11 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x26b4   Process Name:  C:\Windows\System32\svchost.exe  "
2183,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:56:10 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2182,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:56:10 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2181,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:55:15 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2180,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:55:15 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2179,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:54:22 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2178,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:54:22 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2177,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:54:19 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2176,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:54:19 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2175,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:54:10 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-501   Account Name:  Guest   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1b08   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
2174,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:54:05 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2173,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:54:05 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2172,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:54:02 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2171,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:54:02 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2170,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:53:57 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2169,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:53:57 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2168,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:53:52 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2167,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:53:52 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2166,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:53:51 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x1094   Process Name:  C:\Windows\System32\svchost.exe  "
2165,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:53:51 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x1094   Process Name:  C:\Windows\System32\svchost.exe  "
2164,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:53:51 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2163,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:53:51 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2162,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:53:49 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2161,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:53:49 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2160,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:53:00 PM,4634,None,"An account was logged off.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1e30f34    Logon Type:   2    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.  "
2159,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:53:00 PM,4634,None,"An account was logged off.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1e30f52    Logon Type:   2    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.  "
2158,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:53:00 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1e30f34    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2157,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:53:00 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1e30f52   Linked Logon ID:  0x1e30f34   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x758   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2156,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:53:00 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1e30f34   Linked Logon ID:  0x1e30f52   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x758   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2155,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:53:00 PM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x758   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
2154,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:52:19 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x308   Process Name:  C:\Windows\System32\LogonUI.exe  "
2153,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:50:59 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2152,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:50:59 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2151,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:50:53 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x2360   Process Name:  C:\Windows\System32\svchost.exe  "
2150,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:50:53 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x2360   Process Name:  C:\Windows\System32\svchost.exe  "
2149,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:50:52 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2148,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:50:52 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2147,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:50:49 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2146,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,11/30/2017 2:50:49 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2145,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 4:12:25 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x308   Process Name:  C:\Windows\System32\LogonUI.exe  "
2144,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 4:05:43 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2143,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 4:05:43 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2142,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:40:56 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2141,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:40:56 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2140,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:40:30 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2139,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:40:30 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2138,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:40:30 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2137,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:40:30 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2136,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:40:29 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2135,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:40:29 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2134,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:40:14 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2133,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:40:14 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2132,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:39:25 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2131,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:39:25 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2130,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:34:45 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2129,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:34:45 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2128,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:28:41 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2127,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:28:41 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2126,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:20:34 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x21c534    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: WDAGUtilityAccount   Target Account Domain: MSEDGEWIN10  "
2125,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:20:34 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x21c534    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: sshd_server   Target Account Domain: MSEDGEWIN10  "
2124,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:20:34 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x21c534    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: sshd   Target Account Domain: MSEDGEWIN10  "
2123,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:20:34 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x21c534    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Guest   Target Account Domain: MSEDGEWIN10  "
2122,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:20:34 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x21c534    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: DefaultAccount   Target Account Domain: MSEDGEWIN10  "
2121,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:20:34 PM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x21c534    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Administrator   Target Account Domain: MSEDGEWIN10  "
2120,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:19:43 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2119,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:19:43 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2118,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:16:59 PM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
2117,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:16:59 PM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Key File Operation Information:   File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\cd455911c6bd0dcc9201580bceecbda5_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
2116,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:16:58 PM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
2115,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:16:58 PM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Key File Operation Information:   File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\cd455911c6bd0dcc9201580bceecbda5_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
2114,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:16:56 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2113,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:16:56 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2112,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:16:56 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2111,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:16:56 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2110,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:16:56 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2109,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:16:56 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2108,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:16:52 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2107,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:16:52 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2106,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:16:14 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2105,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:16:14 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2104,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:15:15 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2103,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 3:15:15 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2102,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:45:01 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x18c8   Process Name:  C:\Windows\System32\VSSVC.exe  "
2101,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:45:01 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x18c8   Process Name:  C:\Windows\System32\VSSVC.exe  "
2100,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:45:01 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x18c8   Process Name:  C:\Windows\System32\VSSVC.exe  "
2099,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:45:01 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x18c8   Process Name:  C:\Windows\System32\VSSVC.exe  "
2098,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:45:01 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x18c8   Process Name:  C:\Windows\System32\VSSVC.exe  "
2097,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:45:01 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x18c8   Process Name:  C:\Windows\System32\VSSVC.exe  "
2096,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:45:01 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2095,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:45:01 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2094,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:45:01 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x18c8   Process Name:  C:\Windows\System32\VSSVC.exe  "
2093,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:45:01 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x18c8   Process Name:  C:\Windows\System32\VSSVC.exe  "
2092,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:45:01 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2091,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:45:01 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2090,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:44:05 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2089,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:44:05 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2088,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:34:55 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2087,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:34:55 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2086,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:32:44 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2085,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:32:44 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2084,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:31:18 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2083,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:31:18 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2082,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:30:51 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2081,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:30:51 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2080,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:29:13 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2079,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:29:13 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2078,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:29:08 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2077,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:29:08 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2076,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:27:31 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2075,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:27:31 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2074,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:26:41 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2073,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:26:41 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2072,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:26:40 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2071,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:26:40 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2070,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:26:40 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2069,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:26:40 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2068,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:24:50 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2067,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:24:50 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2066,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:19:58 PM,4616,None,"The system time was changed.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Process Information:   Process ID: 0x11a0   Name:  C:\Windows\System32\svchost.exe    Previous Time:  2017-10-26T22:19:58.032024300Z  New Time:  2017-10-26T22:19:58.031935900Z    This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.  "
2065,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:19:41 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2064,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:19:41 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2063,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:19:40 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x734   Process Name:  C:\Windows\System32\VSSVC.exe  "
2062,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:19:40 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x734   Process Name:  C:\Windows\System32\VSSVC.exe  "
2061,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:19:40 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x734   Process Name:  C:\Windows\System32\VSSVC.exe  "
2060,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:19:40 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x734   Process Name:  C:\Windows\System32\VSSVC.exe  "
2059,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:19:40 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x734   Process Name:  C:\Windows\System32\VSSVC.exe  "
2058,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:19:40 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x734   Process Name:  C:\Windows\System32\VSSVC.exe  "
2057,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:19:40 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2056,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:19:40 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2055,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:19:40 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x734   Process Name:  C:\Windows\System32\VSSVC.exe  "
2054,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:19:40 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x734   Process Name:  C:\Windows\System32\VSSVC.exe  "
2053,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:19:40 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2052,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:19:40 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2051,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:19:40 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2050,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:19:40 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2049,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:19:40 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2048,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:19:40 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2047,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:15:32 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2046,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:15:32 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2045,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:15:27 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2044,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:15:27 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2043,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:15:08 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2042,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:15:08 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2041,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:14:34 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2040,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:14:34 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2039,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:35 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2038,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:35 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2037,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:29 PM,4634,None,"An account was logged off.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xd85211    Logon Type:   2    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.  "
2036,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:29 PM,4634,None,"An account was logged off.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xd8522e    Logon Type:   2    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.  "
2035,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:29 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xd85211    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2034,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:29 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xd8522e   Linked Logon ID:  0xd85211   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x758   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2033,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:29 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xd85211   Linked Logon ID:  0xd8522e   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x758   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2032,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:29 PM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x758   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
2031,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:25 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2030,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:25 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2029,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:19 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2028,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:19 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2027,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:17 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2026,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:17 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2025,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:14 PM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
2024,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:14 PM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Key File Operation Information:   File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\cd455911c6bd0dcc9201580bceecbda5_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
2023,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:14 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2022,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:14 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2021,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:14 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-501   Account Name:  Guest   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1d04   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
2020,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:13 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2019,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:13 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2018,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:12 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2017,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:12 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2016,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:11 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x484   Process Name:  C:\Windows\System32\svchost.exe  "
2015,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:11 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x484   Process Name:  C:\Windows\System32\svchost.exe  "
2014,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:11 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2013,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:07:11 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2012,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:05:30 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xfcc   Process Name:  C:\Windows\System32\LogonUI.exe  "
2011,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:04:22 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2010,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:04:22 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2009,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:04:21 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2008,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:04:21 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2007,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:04:14 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xfcc   Process Name:  C:\Windows\System32\LogonUI.exe  "
2006,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:04:12 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2005,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/26/2017 2:04:12 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2004,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 2:26:52 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2003,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 2:26:52 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2002,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 2:25:47 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
2001,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 2:25:47 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
2000,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 2:25:33 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1999,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 2:25:33 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1998,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 2:06:34 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1997,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 2:06:34 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1996,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 2:04:39 PM,4616,None,"The system time was changed.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Process Information:   Process ID: 0x2290   Name:  C:\Windows\System32\svchost.exe    Previous Time:  2017-10-24T22:04:39.994165900Z  New Time:  2017-10-24T22:04:39.994141300Z    This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.  "
1995,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 2:04:39 PM,4616,None,"The system time was changed.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Process Information:   Process ID: 0x2290   Name:  C:\Windows\System32\svchost.exe    Previous Time:  2017-10-24T22:04:39.993108400Z  New Time:  2017-10-24T22:04:39.993065600Z    This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.  "
1994,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 2:04:39 PM,4616,None,"The system time was changed.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Process Information:   Process ID: 0x2290   Name:  C:\Windows\System32\svchost.exe    Previous Time:  2017-10-25T06:03:22.593377500Z  New Time:  2017-10-24T22:04:39.991349500Z    This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.  "
1993,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 10:03:09 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1992,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 10:03:09 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1991,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 10:03:06 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1990,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 10:03:06 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1989,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 10:03:05 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x13d8   Process Name:  C:\Windows\System32\VSSVC.exe  "
1988,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 10:03:05 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x13d8   Process Name:  C:\Windows\System32\VSSVC.exe  "
1987,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 10:03:04 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x13d8   Process Name:  C:\Windows\System32\VSSVC.exe  "
1986,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 10:03:04 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x13d8   Process Name:  C:\Windows\System32\VSSVC.exe  "
1985,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 10:03:04 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x13d8   Process Name:  C:\Windows\System32\VSSVC.exe  "
1984,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 10:03:04 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x13d8   Process Name:  C:\Windows\System32\VSSVC.exe  "
1983,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 10:03:04 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1982,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 10:03:04 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1981,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 10:03:04 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x13d8   Process Name:  C:\Windows\System32\VSSVC.exe  "
1980,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 10:03:04 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x13d8   Process Name:  C:\Windows\System32\VSSVC.exe  "
1979,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 10:03:04 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1978,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 10:03:04 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1977,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 10:03:03 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1976,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 10:03:03 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1975,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 10:03:03 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1974,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 10:03:03 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1973,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 10:03:03 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1972,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 10:03:03 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1971,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 10:02:12 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1970,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 10:02:12 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1969,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:59:54 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1968,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:59:54 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1967,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:59:45 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-546   Group Name:  Guests   Group Domain:  Builtin    Process Information:   Process ID:  0x128c   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
1966,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:59:45 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-545   Group Name:  Users   Group Domain:  Builtin    Process Information:   Process ID:  0x128c   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
1965,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:59:45 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x128c   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
1964,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:59:45 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-504   Account Name:  WDAGUtilityAccount   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x128c   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
1963,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:59:45 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x128c   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
1962,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:59:45 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1002   Account Name:  sshd   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x128c   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
1961,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:59:45 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x128c   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
1960,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:59:45 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-501   Account Name:  Guest   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x128c   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
1959,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:59:45 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-503   Account Name:  DefaultAccount   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x128c   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
1958,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:59:45 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-500   Account Name:  Administrator   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x128c   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
1957,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:59:39 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-501   Account Name:  Guest   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x23a0   Process Name:  C:\Windows\System32\CompatTelRunner.exe  "
1956,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:59:37 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1955,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:59:37 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1954,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:59:36 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x1f54   Process Name:  C:\Windows\System32\svchost.exe  "
1953,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:59:36 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x1f54   Process Name:  C:\Windows\System32\svchost.exe  "
1952,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:59:36 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1951,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:59:36 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1950,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:59:35 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1949,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:59:35 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1948,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:59:35 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1947,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:59:35 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1946,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:56:41 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1945,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:56:41 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1944,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:56:38 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1943,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:56:38 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1942,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:56:35 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1941,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:56:35 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1940,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:55:31 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1939,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:55:31 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1938,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:55:17 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1937,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:55:17 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1936,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:55:17 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x528   Process Name:  C:\Windows\System32\svchost.exe  "
1935,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:55:17 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x21c517    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1934,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:55:17 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x21c534   Linked Logon ID:  0x21c517   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x758   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1933,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:55:17 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x21c517   Linked Logon ID:  0x21c534   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x758   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1932,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:55:17 PM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x758   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
1931,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:55:10 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1930,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:55:10 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1929,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:55:08 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1d68   Process Name:  C:\Windows\System32\LogonUI.exe  "
1928,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:55:08 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-2   Account Name:  DWM-2   Account Domain:  Window Manager   Logon ID:  0x1f24e1    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege  "
1927,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:55:08 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-2   Account Name:  DWM-2   Account Domain:  Window Manager   Logon ID:  0x1f2435    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
1926,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:55:08 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-2   Account Name:  DWM-2   Account Domain:  Window Manager   Logon ID:  0x1f24e1   Linked Logon ID:  0x1f2435   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0xd74   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1925,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:55:08 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-2   Account Name:  DWM-2   Account Domain:  Window Manager   Logon ID:  0x1f2435   Linked Logon ID:  0x1f24e1   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0xd74   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1924,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:55:08 PM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  DWM-2   Account Domain:  Window Manager   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0xd74   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
1923,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:55:08 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-2   Account Name:  UMFD-2   Account Domain:  Font Driver Host   Logon ID:  0x1f1a57   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0xd74   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1922,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:55:08 PM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-2   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0xd74   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
1921,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:55:08 PM,4634,None,"An account was logged off.    Subject:   Security ID:  S-1-5-96-0-1   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon ID:  0x8403    Logon Type:   2    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.  "
1920,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:55:08 PM,4634,None,"An account was logged off.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xec49    Logon Type:   2    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.  "
1919,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:55:08 PM,4634,None,"An account was logged off.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xec62    Logon Type:   2    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.  "
1918,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:55:08 PM,4647,None,"User initiated logoff:    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xcebff    This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.  "
1917,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:54:29 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1916,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:54:29 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1915,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:54:23 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1914,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:54:23 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1913,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:54:23 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1912,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:54:23 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1911,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:54:08 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1910,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:54:08 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1909,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:54:01 PM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
1908,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:54:01 PM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Key File Operation Information:   File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\cd455911c6bd0dcc9201580bceecbda5_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
1907,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:54:00 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1906,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:54:00 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1905,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:54:00 PM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
1904,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:54:00 PM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Key File Operation Information:   File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\cd455911c6bd0dcc9201580bceecbda5_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
1903,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:59 PM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
1902,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:59 PM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Key File Operation Information:   File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\cd455911c6bd0dcc9201580bceecbda5_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
1901,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:56 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1900,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:56 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1899,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:56 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x528   Process Name:  C:\Windows\System32\svchost.exe  "
1898,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:56 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1897,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:56 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1896,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:56 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xcebe2    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1895,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:56 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xcebff   Linked Logon ID:  0xcebe2   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x758   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1894,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:56 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xcebe2   Linked Logon ID:  0xcebff   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x758   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1893,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:56 PM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x758   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
1892,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:46 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1891,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:46 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1890,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:45 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1889,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:45 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1888,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:25 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x115c   Process Name:  C:\Windows\System32\LogonUI.exe  "
1887,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:25 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x9c0   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
1886,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:25 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x9c0   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
1885,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:25 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1884,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:25 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1883,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:20 PM,5059,None,"Key migration operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Additional Information:   Operation: Export of persistent cryptographic key.     Return Code: 0x0  "
1882,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:20 PM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
1881,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:20 PM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Key File Operation Information:   File Path: C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
1880,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:09 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x13c8   Process Name:  C:\Windows\System32\svchost.exe  "
1879,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:09 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x13c8   Process Name:  C:\Windows\System32\svchost.exe  "
1878,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:06 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1877,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:53:06 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1876,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:52:15 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x115c   Process Name:  C:\Windows\System32\LogonUI.exe  "
1875,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:51 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1874,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:51 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1873,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:50 PM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
1872,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:50 PM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Key File Operation Information:   File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\cd455911c6bd0dcc9201580bceecbda5_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
1871,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:48 PM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
1870,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:48 PM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Key File Operation Information:   File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\cd455911c6bd0dcc9201580bceecbda5_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
1869,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:46 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1868,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:46 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1867,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:46 PM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
1866,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:46 PM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Key File Operation Information:   File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\cd455911c6bd0dcc9201580bceecbda5_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
1865,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:44 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1864,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:44 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1863,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:40 PM,5059,None,"Key migration operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Additional Information:   Operation: Export of persistent cryptographic key.     Return Code: 0x0  "
1862,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:40 PM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
1861,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:40 PM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Key File Operation Information:   File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\cd455911c6bd0dcc9201580bceecbda5_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
1860,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:40 PM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
1859,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:40 PM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Key File Operation Information:   File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\cd455911c6bd0dcc9201580bceecbda5_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
1858,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:33 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1857,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:33 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1856,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:33 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x115c   Process Name:  C:\Windows\System32\LogonUI.exe  "
1855,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:32 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x11e0   Process Name:  C:\Windows\System32\VSSVC.exe  "
1854,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:32 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x11e0   Process Name:  C:\Windows\System32\VSSVC.exe  "
1853,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:32 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x11e0   Process Name:  C:\Windows\System32\VSSVC.exe  "
1852,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:32 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x11e0   Process Name:  C:\Windows\System32\VSSVC.exe  "
1851,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:32 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x11e0   Process Name:  C:\Windows\System32\VSSVC.exe  "
1850,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:32 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x11e0   Process Name:  C:\Windows\System32\VSSVC.exe  "
1849,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:32 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x11e0   Process Name:  C:\Windows\System32\VSSVC.exe  "
1848,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:32 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x11e0   Process Name:  C:\Windows\System32\VSSVC.exe  "
1847,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:32 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1846,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:32 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1845,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:30 PM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x1a8da    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xe30   Process Name:  C:\Program Files\OpenSSH\bin\cygrunsrv.exe  "
1844,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:29 PM,5059,None,"Key migration operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Additional Information:   Operation: Export of persistent cryptographic key.     Return Code: 0x0  "
1843,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:29 PM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
1842,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:29 PM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Key File Operation Information:   File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\cd455911c6bd0dcc9201580bceecbda5_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
1841,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:29 PM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
1840,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:29 PM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Key File Operation Information:   File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\cd455911c6bd0dcc9201580bceecbda5_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
1839,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:29 PM,5059,None,"Key migration operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Additional Information:   Operation: Export of persistent cryptographic key.     Return Code: 0x0  "
1838,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:29 PM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
1837,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:29 PM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Key File Operation Information:   File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\cd455911c6bd0dcc9201580bceecbda5_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
1836,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:29 PM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
1835,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:29 PM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Key File Operation Information:   File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\cd455911c6bd0dcc9201580bceecbda5_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
1834,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:28 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x528   Process Name:  C:\Windows\System32\svchost.exe  "
1833,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:28 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1832,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:28 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1831,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:28 PM,5059,None,"Key migration operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Additional Information:   Operation: Export of persistent cryptographic key.     Return Code: 0x0  "
1830,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:28 PM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
1829,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:28 PM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Key File Operation Information:   File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\cd455911c6bd0dcc9201580bceecbda5_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
1828,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:28 PM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
1827,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:28 PM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Key File Operation Information:   File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\cd455911c6bd0dcc9201580bceecbda5_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
1826,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:27 PM,5059,None,"Key migration operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Additional Information:   Operation: Export of persistent cryptographic key.     Return Code: 0x0  "
1825,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:27 PM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
1824,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:27 PM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Key File Operation Information:   File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\cd455911c6bd0dcc9201580bceecbda5_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
1823,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:27 PM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
1822,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:27 PM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Key File Operation Information:   File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\cd455911c6bd0dcc9201580bceecbda5_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
1821,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:27 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1820,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:27 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1819,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:27 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1818,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:27 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1817,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:26 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1816,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:26 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1815,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:26 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x8bc   Process Name:  C:\Windows\System32\svchost.exe  "
1814,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:26 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x8bc   Process Name:  C:\Windows\System32\svchost.exe  "
1813,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:24 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x8a4   Process Name:  C:\Windows\System32\svchost.exe  "
1812,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:24 PM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x8a4   Process Name:  C:\Windows\System32\svchost.exe  "
1811,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:24 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1810,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:24 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1809,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:24 PM,5024,None,"The Windows Firewall service started successfully.  "
1808,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:24 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1807,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:24 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1806,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:23 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1805,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:23 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1804,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:23 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1803,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:23 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1802,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:23 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1801,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:23 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1800,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:23 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x1a8da    Privileges:  SeCreateTokenPrivilege     SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1799,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:23 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x1a8da   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1798,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:23 PM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
1797,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:23 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1796,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:23 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1795,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:23 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1794,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:23 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1793,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:23 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1792,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:23 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1791,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:23 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1790,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:23 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1789,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:22 PM,5033,None,"The Windows Firewall Driver started successfully.  "
1788,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:22 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1787,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:22 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1786,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:22 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1785,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:22 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1784,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:22 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1783,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:22 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1782,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:22 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1781,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:22 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1780,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:22 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1779,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:22 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1778,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:22 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1777,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:22 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1776,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:21 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1775,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:21 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1774,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:21 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1773,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:21 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1772,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:21 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1771,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:21 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1770,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:21 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
1769,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:21 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1768,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:21 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1767,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:21 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1766,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:21 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1765,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:21 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1764,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:21 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xec62    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege  "
1763,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:21 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xec49    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
1762,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:21 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xec62   Linked Logon ID:  0xec49   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x21c   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1761,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:21 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xec49   Linked Logon ID:  0xec62   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x21c   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1760,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:21 PM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  DWM-1   Account Domain:  Window Manager   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x21c   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
1759,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:21 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1758,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:21 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1757,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:21 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
1756,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:21 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1755,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:20 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1754,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:20 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1753,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:20 PM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1752,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:20 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x250   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1751,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:20 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-1   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon ID:  0x8403   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x21c   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1750,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:20 PM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x21c   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
1749,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:20 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-0   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon ID:  0x83c4   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1c8   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1748,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:20 PM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1c8   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
1747,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:20 PM,4902,None,"The Per-user audit policy table was created.    Number of Elements: 0  Policy ID: 0x8244  "
1746,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:20 PM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Logon Information:   Logon Type:  0   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  -    New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4   Process Name:  ?    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  -   Authentication Package: -   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1745,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:20 PM,4608,None,"Windows is starting up.    This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.  "
1744,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:20 PM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x258   New Process Name: ??????????????e??? ????????? ???????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1c8   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1743,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:20 PM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x250   New Process Name: ????????????????-??6??8????0--?0???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1c8   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1742,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:20 PM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x21c   New Process Name: ????????????????-??6??0????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1c0   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1741,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:20 PM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1d0   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1c0   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1740,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:20 PM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1c8   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x16c   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1739,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:20 PM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1c0   New Process Name: ??????????????-??6??0????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x120   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1738,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:20 PM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x178   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x16c   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1737,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:20 PM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x16c   New Process Name: ??????????????-??6??0????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x120   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1736,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:16 PM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x134   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x120   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1735,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:16 PM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x120   New Process Name: ??????????????-??6?4????0--?0???????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x4   Creator Process Name: ???????   Process Command Line: ????0--?0???????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1734,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/24/2017 9:51:16 PM,4826,None,"Boot Configuration Data loaded.    Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    General Settings:   Load Options:  -   Advanced Options:  No     Configuration Access Policy: Default     System Event Logging: No     Kernel Debugging: No     VSM Launch Type: Off      Signature Settings:   Test Signing:  No     Flight Signing:  No     Disable Integrity Checks: No      HyperVisor Settings:   HyperVisor Load Options: -   HyperVisor Launch Type: Off     HyperVisor Debugging: No    "
1733,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:26:31 AM,4647,None,"User initiated logoff:    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1ec6d    This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.  "
1732,Security,Microsoft-Windows-Eventlog,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:26:32 AM,1100,None,"The event logging service has shut down.  "
1731,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:26:07 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1730,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:26:07 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1729,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:26:01 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1728,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:26:01 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1727,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:26:00 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1726,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:26:00 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1725,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:26:00 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x670   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1724,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:26:00 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x670   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1723,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:26:00 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x670   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1722,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:26:00 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x670   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1721,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:26:00 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1534   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1720,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:26:00 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1534   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1719,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:26:00 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1534   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1718,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:26:00 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1534   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1717,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:59 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x12b0   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1716,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:59 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x12b0   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1715,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:59 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x12b0   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1714,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:59 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x12b0   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1713,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:59 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xf80   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1712,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:59 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xf80   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1711,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:59 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xf80   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1710,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:59 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xf80   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1709,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:59 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x50c   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1708,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:59 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x50c   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1707,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:59 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x50c   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1706,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:59 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x50c   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1705,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:59 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1724   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1704,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:59 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1724   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1703,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:59 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1724   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1702,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:59 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1724   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1701,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:59 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x185c   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1700,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:59 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x185c   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1699,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:59 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x185c   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1698,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:59 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x185c   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1697,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:58 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xd8c   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1696,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:58 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xd8c   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1695,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:58 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xd8c   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1694,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:58 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xd8c   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1693,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:58 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xf50   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1692,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:58 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xf50   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1691,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:58 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xf50   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1690,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:58 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xf50   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1689,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:58 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x15ac   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1688,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:58 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x15ac   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1687,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:58 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x15ac   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1686,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:58 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x15ac   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1685,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:57 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1684,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:57 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1683,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:04 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1682,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:25:04 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1681,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:21:42 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1680,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:21:42 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1679,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:20:24 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1678,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:20:24 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1677,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:19:15 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1676,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:19:15 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1675,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:19:00 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1674,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:19:00 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1673,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:09:20 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1672,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 11:09:20 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1671,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:54:07 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1670,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:54:07 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1669,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:53:06 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1668,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:53:06 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1667,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:51:59 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1666,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:51:59 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1665,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:51:06 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1664,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:51:06 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1663,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:46:59 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1662,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:46:59 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1661,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:46:54 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1660,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:46:54 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1659,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:46:53 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1658,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:46:53 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1657,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:41:54 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1656,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:41:54 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1655,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:41:53 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1654,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:41:53 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1653,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:41:53 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1652,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:41:53 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1651,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:39:12 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1650,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:39:12 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1649,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:38:59 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1648,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:38:59 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1647,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:38:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1646,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:38:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1645,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:38:16 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1644,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:38:16 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1643,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:36:52 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1642,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:36:52 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1641,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:35:03 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1640,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:35:03 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1639,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:30:31 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1638,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:30:31 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1637,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:30:31 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1636,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:30:31 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1635,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:29:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1634,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:29:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1633,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:28:53 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1632,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:28:53 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1631,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:28:53 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1630,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:28:53 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1629,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:28:16 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1628,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:28:16 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1627,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:28:14 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1626,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:28:14 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1625,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:28:01 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1608   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1624,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:28:01 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1608   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1623,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:28:01 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1608   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1622,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:28:01 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1608   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1621,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:28:01 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1638   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1620,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:28:01 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1638   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1619,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:28:01 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1638   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1618,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:28:01 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1638   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1617,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:28:00 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x554   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1616,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:28:00 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x554   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1615,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:28:00 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x554   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1614,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:28:00 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x554   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1613,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:28:00 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1ab8   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1612,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:28:00 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1ab8   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1611,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:28:00 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1ab8   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1610,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:28:00 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1ab8   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1609,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:58 AM,5890,None,"An object was added to the COM+ Catalog.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  999    Object:   COM+ Catalog Collection: UsersInRole   Object Name:       ApplId = {10A91BF3-D6B2-4B07-94D9-B83CAFB6FDF4}    Name = Administrators    User = SYSTEM   Object Details:       <null>  "
1608,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:58 AM,5890,None,"An object was added to the COM+ Catalog.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  999    Object:   COM+ Catalog Collection: UsersInRole   Object Name:       ApplId = {10A91BF3-D6B2-4B07-94D9-B83CAFB6FDF4}    Name = Administrators    User = .\Administrators   Object Details:       <null>  "
1607,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:58 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-504   Account Name:  WDAGUtilityAccount   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xf44   Process Name:  C:\Windows\System32\wbem\WmiPrvSE.exe  "
1606,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:58 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xf44   Process Name:  C:\Windows\System32\wbem\WmiPrvSE.exe  "
1605,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:58 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1002   Account Name:  sshd   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xf44   Process Name:  C:\Windows\System32\wbem\WmiPrvSE.exe  "
1604,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:58 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xf44   Process Name:  C:\Windows\System32\wbem\WmiPrvSE.exe  "
1603,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:58 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-501   Account Name:  Guest   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xf44   Process Name:  C:\Windows\System32\wbem\WmiPrvSE.exe  "
1602,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:58 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-503   Account Name:  DefaultAccount   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xf44   Process Name:  C:\Windows\System32\wbem\WmiPrvSE.exe  "
1601,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:58 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-500   Account Name:  Administrator   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xf44   Process Name:  C:\Windows\System32\wbem\WmiPrvSE.exe  "
1600,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:58 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-504   Account Name:  WDAGUtilityAccount   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xf44   Process Name:  C:\Windows\System32\wbem\WmiPrvSE.exe  "
1599,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:58 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xf44   Process Name:  C:\Windows\System32\wbem\WmiPrvSE.exe  "
1598,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:58 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1002   Account Name:  sshd   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xf44   Process Name:  C:\Windows\System32\wbem\WmiPrvSE.exe  "
1597,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:58 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xf44   Process Name:  C:\Windows\System32\wbem\WmiPrvSE.exe  "
1596,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:58 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-501   Account Name:  Guest   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xf44   Process Name:  C:\Windows\System32\wbem\WmiPrvSE.exe  "
1595,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:58 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-503   Account Name:  DefaultAccount   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xf44   Process Name:  C:\Windows\System32\wbem\WmiPrvSE.exe  "
1594,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:58 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-500   Account Name:  Administrator   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xf44   Process Name:  C:\Windows\System32\wbem\WmiPrvSE.exe  "
1593,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:58 AM,5890,None,"An object was added to the COM+ Catalog.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  999    Object:   COM+ Catalog Collection: Roles   Object Name:       ApplId = {10A91BF3-D6B2-4B07-94D9-B83CAFB6FDF4}    Name = Administrators   Object Details:       Description = Administrators group  "
1592,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:58 AM,5890,None,"An object was added to the COM+ Catalog.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  999    Object:   COM+ Catalog Collection: Applications   Object Name:       ID = {10A91BF3-D6B2-4B07-94D9-B83CAFB6FDF4}    AppPartitionID = {41E90F3E-56C1-4633-81C3-6E8BAC8BDD70}   Object Details:       Name = VMware Snapshot Provider    ApplicationProxyServerName =     ProcessType = 2    CommandLine =     ServiceName =     RunAsUserType = 1    Identity = Interactive User    Description = VMware Snapshot Provider    IsSystem = N    Authentication = 6    ShutdownAfter = 3    RunForever = N    Password = ********    Activation = Local    Changeable = Y    Deleteable = Y    CreatedBy =     AccessChecksLevel = 1    ApplicationAccessChecksEnabled = 0    cCOL_SecurityDescriptor = <Opaque>    ImpersonationLevel = 2    AuthenticationCapability = 2    CRMEnabled = 0    3GigSupportEnabled = 0    QueuingEnabled = 0    QueueListenerEnabled = N    EventsEnabled = 1    ProcessFlags = 0    ThreadMax = 0    ApplicationProxy = 0    CRMLogFile =     DumpEnabled = 0    DumpOnException = 0    DumpOnFailfast = 0    MaxDumpCount = 5    DumpPath = %systemroot%\system32\com\dmp    IsEnabled = 1    ConcurrentApps = 1    RecycleLifetimeLimit = 0    RecycleCallLimit = 0    RecycleActivationLimit = 0    RecycleMemoryLimit = 0    RecycleExpirationTimeout = 15    QCListenerMaxThreads = 0    QCAuthenticateMsgs = 0    ApplicationDirectory =     SRPTrustLevel = 262144    SRPEnabled = 0    SoapActivated = 0    SoapVRoot =     SoapMailTo =     SoapBaseUrl =     Replicable = 1  "
1591,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:56 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1590,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:56 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1589,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:55 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1588,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:55 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1587,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:44 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1586,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:44 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1585,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:39 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1584,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:39 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1583,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:38 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1582,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:38 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1581,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:20 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1580,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:20 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1579,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:14 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1578,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:14 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1577,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:14 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1576,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:14 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1575,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:14 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1574,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:14 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1573,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:11 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1572,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:11 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1571,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:09 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1b7c   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1570,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:09 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1b7c   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1569,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:09 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1b7c   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1568,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:09 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1b7c   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1567,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:09 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1b40   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1566,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:09 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1b40   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1565,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:09 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1b40   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1564,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:09 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1b40   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1563,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:09 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1b00   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1562,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:09 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1b00   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1561,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:09 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1b00   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1560,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:09 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1b00   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1559,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:04 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x195c   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1558,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:04 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x195c   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe  "
1557,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:03 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x4fa38    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1556,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:03 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x4fa38   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x191c   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1555,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:03 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x191c   Process Name:  C:\Program Files\OpenSSH\usr\sbin\sshd.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
1554,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:03 AM,5059,None,"Key migration operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Additional Information:   Operation: Export of persistent cryptographic key.     Return Code: 0x0  "
1553,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:03 AM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
1552,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:03 AM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Key File Operation Information:   File Path: C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
1551,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: IEUser   Target Account Domain: MSEDGEWIN10  "
1550,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: WDAGUtilityAccount   Target Account Domain: MSEDGEWIN10  "
1549,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: sshd_server   Target Account Domain: MSEDGEWIN10  "
1548,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: sshd   Target Account Domain: MSEDGEWIN10  "
1547,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: IEUser   Target Account Domain: MSEDGEWIN10  "
1546,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Guest   Target Account Domain: MSEDGEWIN10  "
1545,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: DefaultAccount   Target Account Domain: MSEDGEWIN10  "
1544,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Administrator   Target Account Domain: MSEDGEWIN10  "
1543,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x11bc   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
1542,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x11bc   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
1541,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: IEUser   Target Account Domain: MSEDGEWIN10  "
1540,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: DefaultAccount   Target Account Domain: MSEDGEWIN10  "
1539,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: IEUser   Target Account Domain: MSEDGEWIN10  "
1538,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: WDAGUtilityAccount   Target Account Domain: MSEDGEWIN10  "
1537,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: sshd_server   Target Account Domain: MSEDGEWIN10  "
1536,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: sshd   Target Account Domain: MSEDGEWIN10  "
1535,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: IEUser   Target Account Domain: MSEDGEWIN10  "
1534,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Guest   Target Account Domain: MSEDGEWIN10  "
1533,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: DefaultAccount   Target Account Domain: MSEDGEWIN10  "
1532,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Administrator   Target Account Domain: MSEDGEWIN10  "
1531,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Administrator   Target Account Domain: MSEDGEWIN10  "
1530,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: WDAGUtilityAccount   Target Account Domain: MSEDGEWIN10  "
1529,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: sshd_server   Target Account Domain: MSEDGEWIN10  "
1528,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: sshd   Target Account Domain: MSEDGEWIN10  "
1527,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: IEUser   Target Account Domain: MSEDGEWIN10  "
1526,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Guest   Target Account Domain: MSEDGEWIN10  "
1525,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: DefaultAccount   Target Account Domain: MSEDGEWIN10  "
1524,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Administrator   Target Account Domain: MSEDGEWIN10  "
1523,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: IEUser   Target Account Domain: MSEDGEWIN10  "
1522,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: WDAGUtilityAccount   Target Account Domain: MSEDGEWIN10  "
1521,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: sshd_server   Target Account Domain: MSEDGEWIN10  "
1520,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: sshd   Target Account Domain: MSEDGEWIN10  "
1519,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: IEUser   Target Account Domain: MSEDGEWIN10  "
1518,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Guest   Target Account Domain: MSEDGEWIN10  "
1517,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: DefaultAccount   Target Account Domain: MSEDGEWIN10  "
1516,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Administrator   Target Account Domain: MSEDGEWIN10  "
1515,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1514,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:27:01 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1513,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:58 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1512,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:58 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1511,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:53 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1510,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:53 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1509,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:52 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1508,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:52 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1507,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:52 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xe08   Process Name:  C:\Program Files\OpenSSH\bin\cygrunsrv.exe  "
1506,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:51 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x430   Process Name:  C:\Windows\System32\svchost.exe  "
1505,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:51 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x430   Process Name:  C:\Windows\System32\svchost.exe  "
1504,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:51 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1ec6d    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1503,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:51 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1ec6d   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x490   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1502,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:51 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x490   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
1501,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:50 AM,5024,None,"The Windows Firewall service started successfully.  "
1500,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:50 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1499,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:50 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1498,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:49 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x398   Process Name:  C:\Windows\System32\LogonUI.exe  "
1497,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1496,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1495,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x8e8   Process Name:  C:\Windows\System32\svchost.exe  "
1494,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x8e8   Process Name:  C:\Windows\System32\svchost.exe  "
1493,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1492,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1491,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x8a4   Process Name:  C:\Windows\System32\svchost.exe  "
1490,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x8a4   Process Name:  C:\Windows\System32\svchost.exe  "
1489,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1488,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1487,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1486,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1485,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1484,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1483,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1482,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1481,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4    Privileges:  SeCreateTokenPrivilege     SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1480,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0x157b4   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1479,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:49 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
1478,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1477,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1476,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1475,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1474,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1473,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1472,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:48 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1471,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:48 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1470,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:48 AM,5033,None,"The Windows Firewall Driver started successfully.  "
1469,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:48 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1468,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:48 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1467,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:48 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1466,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:48 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1465,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:48 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1464,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:48 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1463,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:48 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1462,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:48 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1461,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:48 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1460,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:48 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1459,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1458,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1457,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1456,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1455,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
1454,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1453,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbbb0    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
1452,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbbb0   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1ec   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1451,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  DWM-1   Account Domain:  Window Manager   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1ec   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
1450,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1449,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1448,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
1447,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1446,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1445,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1444,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1443,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1442,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-0   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon ID:  0x74fe   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1ac   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1441,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1ac   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
1440,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-1   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon ID:  0x74ec   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1ec   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1439,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1ec   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
1438,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4902,None,"The Per-user audit policy table was created.    Number of Elements: 0  Policy ID: 0x7349  "
1437,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Logon Information:   Logon Type:  0   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  -    New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4   Process Name:  ?    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  -   Authentication Package: -   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1436,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4608,None,"Windows is starting up.    This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.  "
1435,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x23c   New Process Name: ??????????????e??? ????????? ???????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1ac   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1434,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x234   New Process Name: ????????????????-??6??c????0--?0???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1ac   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1433,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1ec   New Process Name: ????????????????-??6??4????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1a4   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1432,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1b4   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1a4   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1431,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1ac   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x158   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1430,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:47 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1a4   New Process Name: ??????????????-??6??c????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x10c   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1429,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:46 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x160   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x158   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1428,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:46 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x158   New Process Name: ??????????????-??6??c????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x10c   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1427,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:46 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x120   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x10c   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1426,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:45 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x10c   New Process Name: ??????????????-??6?4????0--?0???????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x4   Creator Process Name: ???????   Process Command Line: ????0--?0???????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1425,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:45 AM,4826,None,"Boot Configuration Data loaded.    Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    General Settings:   Load Options:  -   Advanced Options:  No     Configuration Access Policy: Default     System Event Logging: No     Kernel Debugging: No     VSM Launch Type: Off      Signature Settings:   Test Signing:  No     Flight Signing:  No     Disable Integrity Checks: No      HyperVisor Settings:   HyperVisor Load Options: -   HyperVisor Launch Type: Off     HyperVisor Debugging: No    "
1424,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:30 AM,4647,None,"User initiated logoff:    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.  "
1423,Security,Microsoft-Windows-Eventlog,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:31 AM,1100,None,"The event logging service has shut down.  "
1422,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:24 AM,4634,None,"An account was logged off.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0xa205a    Logon Type:   5    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.  "
1421,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:19 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0xa205a    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1b00   Process Name:  C:\Program Files\OpenSSH\bin\cygrunsrv.exe  "
1420,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:18 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x440   Process Name:  C:\Windows\System32\svchost.exe  "
1419,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:18 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0xa205a    Privileges:  SeCreateTokenPrivilege     SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1418,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:18 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon ID:  0xa205a   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1417,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:18 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
1416,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:17 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1950   Process Name:  C:\Program Files\OpenSSH\bin\cygrunsrv.exe  "
1415,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:17 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1a9c   Process Name:  C:\Program Files\OpenSSH\bin\chmod.exe  "
1414,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:17 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x7e4   Process Name:  C:\Program Files\OpenSSH\bin\chown.exe  "
1413,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:16 AM,4717,None,"System security access was granted to an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    Account Modified:   Account Name:  S-1-5-21-4233833229-2203495600-2027003190-1003    Access Granted:   Access Right:  SeServiceLogonRight  "
1412,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:16 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1a5c   Process Name:  C:\Program Files\OpenSSH\bin\editrights.exe  "
1411,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:16 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1a3c   Process Name:  C:\Program Files\OpenSSH\bin\editrights.exe  "
1410,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:16 AM,4717,None,"System security access was granted to an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    Account Modified:   Account Name:  S-1-5-21-4233833229-2203495600-2027003190-1003    Access Granted:   Access Right:  SeDenyRemoteInteractiveLogonRight  "
1409,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:16 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1a24   Process Name:  C:\Program Files\OpenSSH\bin\editrights.exe  "
1408,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:15 AM,4717,None,"System security access was granted to an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    Account Modified:   Account Name:  S-1-5-21-4233833229-2203495600-2027003190-1003    Access Granted:   Access Right:  SeDenyNetworkLogonRight  "
1407,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:15 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1524   Process Name:  C:\Program Files\OpenSSH\bin\editrights.exe  "
1406,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:15 AM,4717,None,"System security access was granted to an account.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    Account Modified:   Account Name:  S-1-5-21-4233833229-2203495600-2027003190-1003    Access Granted:   Access Right:  SeDenyInteractiveLogonRight  "
1405,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:15 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xeb0   Process Name:  C:\Program Files\OpenSSH\bin\editrights.exe  "
1404,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:15 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x191c   Process Name:  C:\Program Files\OpenSSH\bin\editrights.exe  "
1403,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:15 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1380   Process Name:  C:\Program Files\OpenSSH\bin\editrights.exe  "
1402,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:15 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1b20   Process Name:  C:\Program Files\OpenSSH\bin\editrights.exe  "
1401,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:15 AM,4732,None,"A member was added to a security-enabled local group.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    Member:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  -    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Additional Information:   Privileges:  -   Expiration time:  (null)  "
1400,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:14 AM,4738,None,"A user account was changed.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Changed Attributes:   SAM Account Name: sshd_server   Display Name:  sshd server account   User Principal Name: -   Home Directory:  C:\Program Files\OpenSSH\var\empty   Home Drive:  <value not set>     Script Path:  <value not set>     Profile Path:  <value not set>     User Workstations: <value not set>     Password Last Set: 10/17/2017 11:26:14 AM   Account Expires:  <never>     Primary Group ID: 513   AllowedToDelegateTo: -   Old UAC Value:  0x10   New UAC Value:  0x210   User Account Control:     'Don't Expire Password' - Enabled     User Parameters: <value not set>     SID History:  -   Logon Hours:  All      Additional Information:   Privileges:  -  "
1399,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:14 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x18c4   Process Name:  C:\Windows\System32\wbem\WmiPrvSE.exe  "
1398,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:14 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x18c4   Process Name:  C:\Windows\System32\wbem\WmiPrvSE.exe  "
1397,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:14 AM,4732,None,"A member was added to a security-enabled local group.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    Member:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  -    Group:   Security ID:  S-1-5-32-545   Group Name:  Users   Group Domain:  Builtin    Additional Information:   Privileges:  -   Expiration time:  (null)  "
1396,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:14 AM,4724,None,"An attempt was made to reset an account's password.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10  "
1395,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:14 AM,4738,None,"A user account was changed.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Changed Attributes:   SAM Account Name: sshd_server   Display Name:  sshd server account   User Principal Name: -   Home Directory:  C:\Program Files\OpenSSH\var\empty   Home Drive:  <value not set>     Script Path:  <value not set>     Profile Path:  <value not set>     User Workstations: <value not set>     Password Last Set: 10/17/2017 11:26:14 AM   Account Expires:  <never>     Primary Group ID: 513   AllowedToDelegateTo: -   Old UAC Value:  0x15   New UAC Value:  0x10   User Account Control:     Account Enabled      'Password Not Required' - Disabled     User Parameters: -   SID History:  -   Logon Hours:  All      Additional Information:   Privileges:  -  "
1394,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:14 AM,4722,None,"A user account was enabled.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10  "
1393,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:14 AM,4720,None,"A user account was created.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    New Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  sshd_server   Account Domain:  MSEDGEWIN10    Attributes:   SAM Account Name: sshd_server   Display Name:  <value not set>     User Principal Name: -   Home Directory:  <value not set>     Home Drive:  <value not set>     Script Path:  <value not set>     Profile Path:  <value not set>     User Workstations: <value not set>     Password Last Set: <never>     Account Expires:  <never>     Primary Group ID: 513   Allowed To Delegate To: -   Old UAC Value:  0x0   New UAC Value:  0x15   User Account Control:     Account Disabled      'Password Not Required' - Enabled      'Normal Account' - Enabled     User Parameters: <value not set>     SID History:  -   Logon Hours:  All      Additional Information:   Privileges  -  "
1392,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:14 AM,4728,None,"A member was added to a security-enabled global group.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    Member:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1003   Account Name:  -    Group:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-513   Group Name:  None   Group Domain:  MSEDGEWIN10    Additional Information:   Privileges:  -  Expiration time:  (null)  "
1391,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:08 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-504   Account Name:  WDAGUtilityAccount   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1aac   Process Name:  C:\Program Files\OpenSSH\bin\mkpasswd.exe  "
1390,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:08 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1002   Account Name:  sshd   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1aac   Process Name:  C:\Program Files\OpenSSH\bin\mkpasswd.exe  "
1389,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:08 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1aac   Process Name:  C:\Program Files\OpenSSH\bin\mkpasswd.exe  "
1388,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:08 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-501   Account Name:  Guest   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1aac   Process Name:  C:\Program Files\OpenSSH\bin\mkpasswd.exe  "
1387,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:08 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-503   Account Name:  DefaultAccount   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1aac   Process Name:  C:\Program Files\OpenSSH\bin\mkpasswd.exe  "
1386,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:08 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-500   Account Name:  Administrator   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1aac   Process Name:  C:\Program Files\OpenSSH\bin\mkpasswd.exe  "
1385,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:08 AM,4738,None,"A user account was changed.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1002   Account Name:  sshd   Account Domain:  MSEDGEWIN10    Changed Attributes:   SAM Account Name: sshd   Display Name:  sshd privsep   User Principal Name: -   Home Directory:  C:\Program Files\OpenSSH\var\empty   Home Drive:  <value not set>     Script Path:  <value not set>     Profile Path:  <value not set>     User Workstations: <value not set>     Password Last Set: 10/17/2017 11:26:07 AM   Account Expires:  <never>     Primary Group ID: 513   AllowedToDelegateTo: -   Old UAC Value:  0x11   New UAC Value:  0x211   User Account Control:     'Don't Expire Password' - Enabled     User Parameters: <value not set>     SID History:  -   Logon Hours:  All      Additional Information:   Privileges:  -  "
1384,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:08 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1002   Account Name:  sshd   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x18c4   Process Name:  C:\Windows\System32\wbem\WmiPrvSE.exe  "
1383,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:08 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1002   Account Name:  sshd   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x18c4   Process Name:  C:\Windows\System32\wbem\WmiPrvSE.exe  "
1382,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:07 AM,4732,None,"A member was added to a security-enabled local group.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    Member:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1002   Account Name:  -    Group:   Security ID:  S-1-5-32-545   Group Name:  Users   Group Domain:  Builtin    Additional Information:   Privileges:  -   Expiration time:  (null)  "
1381,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:07 AM,4738,None,"A user account was changed.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1002   Account Name:  sshd   Account Domain:  MSEDGEWIN10    Changed Attributes:   SAM Account Name: sshd   Display Name:  sshd privsep   User Principal Name: -   Home Directory:  C:\Program Files\OpenSSH\var\empty   Home Drive:  <value not set>     Script Path:  <value not set>     Profile Path:  <value not set>     User Workstations: <value not set>     Password Last Set: 10/17/2017 11:26:07 AM   Account Expires:  <never>     Primary Group ID: 513   AllowedToDelegateTo: -   Old UAC Value:  0x15   New UAC Value:  0x11   User Account Control:     'Password Not Required' - Disabled     User Parameters: <value not set>     SID History:  -   Logon Hours:  All      Additional Information:   Privileges:  -  "
1380,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:07 AM,4720,None,"A user account was created.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    New Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1002   Account Name:  sshd   Account Domain:  MSEDGEWIN10    Attributes:   SAM Account Name: sshd   Display Name:  <value not set>     User Principal Name: -   Home Directory:  <value not set>     Home Drive:  <value not set>     Script Path:  <value not set>     Profile Path:  <value not set>     User Workstations: <value not set>     Password Last Set: <never>     Account Expires:  <never>     Primary Group ID: 513   Allowed To Delegate To: -   Old UAC Value:  0x0   New UAC Value:  0x15   User Account Control:     Account Disabled      'Password Not Required' - Enabled      'Normal Account' - Enabled     User Parameters: <value not set>     SID History:  -   Logon Hours:  All      Additional Information:   Privileges  -  "
1379,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:07 AM,4728,None,"A member was added to a security-enabled global group.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    Member:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1002   Account Name:  -    Group:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-513   Group Name:  None   Group Domain:  MSEDGEWIN10    Additional Information:   Privileges:  -  Expiration time:  (null)  "
1378,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:06 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-504   Account Name:  WDAGUtilityAccount   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x19a0   Process Name:  C:\Program Files\OpenSSH\bin\mkpasswd.exe  "
1377,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:06 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x19a0   Process Name:  C:\Program Files\OpenSSH\bin\mkpasswd.exe  "
1376,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:06 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-501   Account Name:  Guest   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x19a0   Process Name:  C:\Program Files\OpenSSH\bin\mkpasswd.exe  "
1375,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:06 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-503   Account Name:  DefaultAccount   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x19a0   Process Name:  C:\Program Files\OpenSSH\bin\mkpasswd.exe  "
1374,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:06 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-500   Account Name:  Administrator   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x19a0   Process Name:  C:\Program Files\OpenSSH\bin\mkpasswd.exe  "
1373,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:06 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x19a0   Process Name:  C:\Program Files\OpenSSH\bin\mkpasswd.exe  "
1372,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:06 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x1960   Process Name:  C:\Program Files\OpenSSH\bin\mkgroup.exe  "
1371,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:02 AM,5059,None,"Key migration operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Additional Information:   Operation: Export of persistent cryptographic key.     Return Code: 0x0  "
1370,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:02 AM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
1369,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:02 AM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Key File Operation Information:   File Path: C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
1368,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: IEUser   Target Account Domain: MSEDGEWIN10  "
1367,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: WDAGUtilityAccount   Target Account Domain: MSEDGEWIN10  "
1366,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: IEUser   Target Account Domain: MSEDGEWIN10  "
1365,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Guest   Target Account Domain: MSEDGEWIN10  "
1364,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: DefaultAccount   Target Account Domain: MSEDGEWIN10  "
1363,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Administrator   Target Account Domain: MSEDGEWIN10  "
1362,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x172c   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
1361,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x172c   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
1360,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: IEUser   Target Account Domain: MSEDGEWIN10  "
1359,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: WDAGUtilityAccount   Target Account Domain: MSEDGEWIN10  "
1358,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: IEUser   Target Account Domain: MSEDGEWIN10  "
1357,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Guest   Target Account Domain: MSEDGEWIN10  "
1356,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: DefaultAccount   Target Account Domain: MSEDGEWIN10  "
1355,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Administrator   Target Account Domain: MSEDGEWIN10  "
1354,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: IEUser   Target Account Domain: MSEDGEWIN10  "
1353,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: DefaultAccount   Target Account Domain: MSEDGEWIN10  "
1352,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Administrator   Target Account Domain: MSEDGEWIN10  "
1351,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: WDAGUtilityAccount   Target Account Domain: MSEDGEWIN10  "
1350,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: IEUser   Target Account Domain: MSEDGEWIN10  "
1349,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Guest   Target Account Domain: MSEDGEWIN10  "
1348,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: DefaultAccount   Target Account Domain: MSEDGEWIN10  "
1347,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Administrator   Target Account Domain: MSEDGEWIN10  "
1346,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: IEUser   Target Account Domain: MSEDGEWIN10  "
1345,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: WDAGUtilityAccount   Target Account Domain: MSEDGEWIN10  "
1344,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: IEUser   Target Account Domain: MSEDGEWIN10  "
1343,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Guest   Target Account Domain: MSEDGEWIN10  "
1342,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: DefaultAccount   Target Account Domain: MSEDGEWIN10  "
1341,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:01 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Administrator   Target Account Domain: MSEDGEWIN10  "
1340,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:00 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1339,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:26:00 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1338,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:51 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1337,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:51 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1336,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:51 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1335,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:51 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1334,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:51 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x440   Process Name:  C:\Windows\System32\svchost.exe  "
1333,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:51 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1332,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:51 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1331,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:50 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1330,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:50 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1329,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:50 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1328,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:50 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1327,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:50 AM,5024,None,"The Windows Firewall service started successfully.  "
1326,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:50 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1325,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:50 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1c766   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4a0   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1324,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:50 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x4a0   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
1323,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:50 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1322,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:50 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1321,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:50 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x958   Process Name:  C:\Windows\System32\svchost.exe  "
1320,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:50 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x958   Process Name:  C:\Windows\System32\svchost.exe  "
1319,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:49 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x394   Process Name:  C:\Windows\System32\LogonUI.exe  "
1318,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1317,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1316,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1315,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1314,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1313,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1312,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1311,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1310,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1309,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1308,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1307,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1306,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1305,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1304,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x8a0   Process Name:  C:\Windows\System32\svchost.exe  "
1303,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x8a0   Process Name:  C:\Windows\System32\svchost.exe  "
1302,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:48 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1301,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:48 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1300,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:48 AM,5033,None,"The Windows Firewall Driver started successfully.  "
1299,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:48 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1298,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:48 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1297,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:48 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1296,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:48 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1295,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:48 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1294,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:48 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1293,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:48 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1292,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:48 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1291,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:48 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1290,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:48 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1289,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1288,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1287,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1286,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1285,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
1284,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1283,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbb6d    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
1282,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbb6d   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1ec   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1281,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  DWM-1   Account Domain:  Window Manager   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1ec   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
1280,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1279,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1278,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
1277,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1276,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1275,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1274,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1273,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1272,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-0   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon ID:  0x74e6   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1ac   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1271,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1ac   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
1270,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-1   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon ID:  0x74b2   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1ec   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1269,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1ec   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
1268,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4902,None,"The Per-user audit policy table was created.    Number of Elements: 0  Policy ID: 0x7323  "
1267,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Logon Information:   Logon Type:  0   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  -    New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4   Process Name:  ?    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  -   Authentication Package: -   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1266,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4608,None,"Windows is starting up.    This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.  "
1265,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x238   New Process Name: ??????????????e??? ????????? ???????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1ac   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1264,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x230   New Process Name: ????????????????-??6??c????0--?0???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1ac   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1263,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1ec   New Process Name: ????????????????-??6??4????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1a4   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1262,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1b4   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1a4   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1261,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1ac   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x158   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1260,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:47 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1a4   New Process Name: ??????????????-??6??c????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x10c   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1259,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:46 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x160   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x158   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1258,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:46 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x158   New Process Name: ??????????????-??6??c????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x10c   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1257,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:46 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x120   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x10c   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1256,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:45 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x10c   New Process Name: ??????????????-??6?4????0--?0???????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x4   Creator Process Name: ???????   Process Command Line: ????0--?0???????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1255,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:45 AM,4826,None,"Boot Configuration Data loaded.    Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    General Settings:   Load Options:  -   Advanced Options:  No     Configuration Access Policy: Default     System Event Logging: No     Kernel Debugging: No     VSM Launch Type: Off      Signature Settings:   Test Signing:  No     Flight Signing:  No     Disable Integrity Checks: No      HyperVisor Settings:   HyperVisor Load Options: -   HyperVisor Launch Type: Off     HyperVisor Debugging: No    "
1254,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:29 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1253,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:29 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1252,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:29 AM,4647,None,"User initiated logoff:    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1b8b6    This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.  "
1251,Security,Microsoft-Windows-Eventlog,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:30 AM,1100,None,"The event logging service has shut down.  "
1250,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:06 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1249,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:06 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1248,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:06 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1247,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:06 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1246,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:05 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1245,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:25:05 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1244,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:35 AM,5059,None,"Key migration operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Additional Information:   Operation: Export of persistent cryptographic key.     Return Code: 0x0  "
1243,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:35 AM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
1242,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:35 AM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Key File Operation Information:   File Path: C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
1241,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:33 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1240,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:33 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1239,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:33 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: IEUser   Target Account Domain: MSEDGEWIN10  "
1238,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:33 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: WDAGUtilityAccount   Target Account Domain: MSEDGEWIN10  "
1237,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:33 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: IEUser   Target Account Domain: MSEDGEWIN10  "
1236,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:33 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Guest   Target Account Domain: MSEDGEWIN10  "
1235,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:33 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: DefaultAccount   Target Account Domain: MSEDGEWIN10  "
1234,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:33 AM,4797,None,"An attempt was made to query the existence of a blank password for an account.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Additional Information:   Caller Workstation: MSEDGEWIN10   Target Account Name: Administrator   Target Account Domain: MSEDGEWIN10  "
1233,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:31 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x1534   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
1232,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:31 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x1534   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
1231,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:31 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1230,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:31 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1229,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:24 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1228,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:24 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1227,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:24 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1226,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:24 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1225,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:24 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x44c   Process Name:  C:\Windows\System32\svchost.exe  "
1224,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:24 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1223,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:24 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1222,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:23 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x894   Process Name:  C:\Windows\System32\svchost.exe  "
1221,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:23 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x894   Process Name:  C:\Windows\System32\svchost.exe  "
1220,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:23 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1219,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:23 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1218,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:23 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1217,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:23 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1216,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:23 AM,5024,None,"The Windows Firewall service started successfully.  "
1215,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:23 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1b8b6    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1214,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:23 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x1b8b6   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4a8   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1213,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:23 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x4a8   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
1212,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:22 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x3a0   Process Name:  C:\Windows\System32\LogonUI.exe  "
1211,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:22 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x87c   Process Name:  C:\Windows\System32\svchost.exe  "
1210,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:22 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x87c   Process Name:  C:\Windows\System32\svchost.exe  "
1209,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:22 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1208,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:22 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1207,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:22 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1206,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:22 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1205,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:22 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1204,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:22 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1203,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:22 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1202,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:22 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1201,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:22 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1200,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:22 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1199,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:22 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1198,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:22 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1197,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:22 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1196,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:22 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1195,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:22 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1194,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:22 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1193,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:21 AM,5033,None,"The Windows Firewall Driver started successfully.  "
1192,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:21 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1191,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:21 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1190,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:21 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1189,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:21 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1188,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:21 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1187,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:21 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1186,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:21 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1185,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:21 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1184,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:21 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1183,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:21 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1182,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:21 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1181,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:21 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1180,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1179,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1178,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
1177,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1176,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbc9f    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
1175,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbc9f   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1ec   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1174,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  DWM-1   Account Domain:  Window Manager   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1ec   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
1173,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1172,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1171,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
1170,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1169,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1168,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1167,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1166,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1165,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-1   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon ID:  0x74ca   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1ec   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1164,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1ec   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
1163,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-0   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon ID:  0x74bc   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1ac   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1162,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1ac   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
1161,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4902,None,"The Per-user audit policy table was created.    Number of Elements: 0  Policy ID: 0x731a  "
1160,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Logon Information:   Logon Type:  0   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  -    New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4   Process Name:  ?    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  -   Authentication Package: -   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1159,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4608,None,"Windows is starting up.    This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.  "
1158,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x23c   New Process Name: ??????????????e??? ????????? ???????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1ac   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1157,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x234   New Process Name: ????????????????-??6??c????0--?0???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1ac   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1156,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1ec   New Process Name: ????????????????-??6??4????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1a4   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1155,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1b4   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1a4   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1154,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1ac   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x158   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1153,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:20 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1a4   New Process Name: ??????????????-??6??c????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x10c   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1152,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:19 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x160   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x158   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1151,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:19 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x158   New Process Name: ??????????????-??6??c????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x10c   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1150,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:19 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x120   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x10c   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1149,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:18 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x10c   New Process Name: ??????????????-??6?4????0--?0???????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x4   Creator Process Name: ???????   Process Command Line: ????0--?0???????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
1148,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:18 AM,4826,None,"Boot Configuration Data loaded.    Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    General Settings:   Load Options:  -   Advanced Options:  No     Configuration Access Policy: Default     System Event Logging: No     Kernel Debugging: No     VSM Launch Type: Off      Signature Settings:   Test Signing:  No     Flight Signing:  No     Disable Integrity Checks: No      HyperVisor Settings:   HyperVisor Load Options: -   HyperVisor Launch Type: Off     HyperVisor Debugging: No    "
1147,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:04 AM,4647,None,"User initiated logoff:    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x33ecc    This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.  "
1146,Security,Microsoft-Windows-Eventlog,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:24:05 AM,1100,None,"The event logging service has shut down.  "
1145,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1144,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1143,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:39 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1142,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:39 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1141,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:23 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x15b4   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
1140,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:23 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x15b4   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
1139,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:23 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1138,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:23 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1137,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:23 AM,5059,None,"Key migration operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Additional Information:   Operation: Export of persistent cryptographic key.     Return Code: 0x0  "
1136,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:23 AM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
1135,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:23 AM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Key File Operation Information:   File Path: C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
1134,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:15 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1133,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:15 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1132,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:15 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1131,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:15 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1130,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:15 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1129,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:15 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1128,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:15 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1127,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:15 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1126,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:11 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1125,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:11 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1124,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:11 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x408   Process Name:  C:\Windows\System32\svchost.exe  "
1123,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:11 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1122,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:11 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1121,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:10 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x33ecc    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1120,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:10 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x33ecc   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x824   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1119,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:10 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x824   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
1118,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:10 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x398   Process Name:  C:\Windows\System32\LogonUI.exe  "
1117,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:09 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1116,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:09 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1115,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:09 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1114,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:09 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1113,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\bootmgr   Handle ID: 0x3c0    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1112,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\zh-TW\memtest.exe.mui   Handle ID: 0x390    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1111,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\zh-TW\bootmgr.exe.mui   Handle ID: 0x390    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1110,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\zh-CN\memtest.exe.mui   Handle ID: 0x390    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1109,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\zh-CN\bootmgr.exe.mui   Handle ID: 0x388    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1108,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\uk-UA\bootmgr.exe.mui   Handle ID: 0x388    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1107,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\tr-TR\memtest.exe.mui   Handle ID: 0x388    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1106,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\tr-TR\bootmgr.exe.mui   Handle ID: 0x388    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1105,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\sv-SE\memtest.exe.mui   Handle ID: 0x388    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1104,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\sv-SE\bootmgr.exe.mui   Handle ID: 0x388    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1103,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\sr-Latn-RS\bootmgr.exe.mui   Handle ID: 0x388    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1102,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\sl-SI\bootmgr.exe.mui   Handle ID: 0x3cc    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1101,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\sk-SK\bootmgr.exe.mui   Handle ID: 0x3cc    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1100,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\ru-RU\memtest.exe.mui   Handle ID: 0x3cc    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1099,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\ru-RU\bootmgr.exe.mui   Handle ID: 0x340    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1098,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\ro-RO\bootmgr.exe.mui   Handle ID: 0x340    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1097,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\qps-ploc\memtest.exe.mui   Handle ID: 0x340    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1096,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\qps-ploc\bootmgr.exe.mui   Handle ID: 0x340    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1095,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\pt-PT\memtest.exe.mui   Handle ID: 0x340    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1094,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\pt-PT\bootmgr.exe.mui   Handle ID: 0x340    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1093,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\pt-BR\memtest.exe.mui   Handle ID: 0x340    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1092,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\pt-BR\bootmgr.exe.mui   Handle ID: 0x340    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1091,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\pl-PL\memtest.exe.mui   Handle ID: 0x2fc    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1090,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\pl-PL\bootmgr.exe.mui   Handle ID: 0x2fc    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1089,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\nl-NL\memtest.exe.mui   Handle ID: 0x2fc    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1088,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\nl-NL\bootmgr.exe.mui   Handle ID: 0x2fc    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1087,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\nb-NO\memtest.exe.mui   Handle ID: 0x2fc    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1086,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\nb-NO\bootmgr.exe.mui   Handle ID: 0x2fc    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1085,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\memtest.exe   Handle ID: 0x3cc    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1084,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\lv-LV\bootmgr.exe.mui   Handle ID: 0x2fc    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1083,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\lt-LT\bootmgr.exe.mui   Handle ID: 0x2fc    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1082,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\ko-KR\memtest.exe.mui   Handle ID: 0x364    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1081,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\ko-KR\bootmgr.exe.mui   Handle ID: 0x364    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1080,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\ja-JP\memtest.exe.mui   Handle ID: 0x338    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1079,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\ja-JP\bootmgr.exe.mui   Handle ID: 0x39c    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1078,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\it-IT\memtest.exe.mui   Handle ID: 0x338    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1077,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\it-IT\bootmgr.exe.mui   Handle ID: 0x338    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1076,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\hu-HU\memtest.exe.mui   Handle ID: 0x338    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1075,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\hu-HU\bootmgr.exe.mui   Handle ID: 0x338    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1074,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\hr-HR\bootmgr.exe.mui   Handle ID: 0x338    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1073,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1072,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1071,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\fr-FR\memtest.exe.mui   Handle ID: 0x338    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1070,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\fr-FR\bootmgr.exe.mui   Handle ID: 0x364    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1069,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\fr-CA\bootmgr.exe.mui   Handle ID: 0x364    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1068,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\fi-FI\memtest.exe.mui   Handle ID: 0x364    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1067,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\fi-FI\bootmgr.exe.mui   Handle ID: 0x364    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1066,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\et-EE\bootmgr.exe.mui   Handle ID: 0x39c    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1065,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\es-MX\bootmgr.exe.mui   Handle ID: 0x390    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1064,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\es-ES\memtest.exe.mui   Handle ID: 0x390    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1063,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\es-ES\bootmgr.exe.mui   Handle ID: 0x390    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1062,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\en-US\memtest.exe.mui   Handle ID: 0x390    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1061,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\en-US\bootmgr.exe.mui   Handle ID: 0x390    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1060,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\en-GB\bootmgr.exe.mui   Handle ID: 0x390    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1059,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\el-GR\memtest.exe.mui   Handle ID: 0x394    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1058,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\el-GR\bootmgr.exe.mui   Handle ID: 0x394    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1057,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\de-DE\memtest.exe.mui   Handle ID: 0x32c    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1056,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\de-DE\bootmgr.exe.mui   Handle ID: 0x32c    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1055,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\da-DK\memtest.exe.mui   Handle ID: 0x32c    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1054,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\da-DK\bootmgr.exe.mui   Handle ID: 0x32c    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1053,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\cs-CZ\memtest.exe.mui   Handle ID: 0x32c    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1052,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\cs-CZ\bootmgr.exe.mui   Handle ID: 0x32c    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1051,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\bootvhd.dll   Handle ID: 0x388    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1050,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\bootnxt   Handle ID: 0x388    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1049,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\bootmgr   Handle ID: 0x388    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1048,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:07 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Boot\bg-BG\bootmgr.exe.mui   Handle ID: 0x32c    Process Information:   Process ID: 0x544   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AINO_ACCESS_CONTROL   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
1047,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:06 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x8f8   Process Name:  C:\Windows\System32\svchost.exe  "
1046,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:06 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x8f8   Process Name:  C:\Windows\System32\svchost.exe  "
1045,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:05 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1044,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:05 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1043,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:05 AM,5024,None,"The Windows Firewall service started successfully.  "
1042,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:04 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1041,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:04 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1040,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:04 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x8e4   Process Name:  C:\Windows\System32\svchost.exe  "
1039,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:04 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x8e4   Process Name:  C:\Windows\System32\svchost.exe  "
1038,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:04 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1037,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:04 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1036,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:04 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1035,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:04 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1034,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:04 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1033,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:04 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1032,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:04 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1031,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:04 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1030,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:04 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1029,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:04 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1028,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:04 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1027,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:04 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1026,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:04 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1025,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:04 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1024,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:03 AM,5033,None,"The Windows Firewall Driver started successfully.  "
1023,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:03 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1022,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:03 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1021,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:03 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1020,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:03 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1019,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:02 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1018,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:02 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1017,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:02 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1016,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:02 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1015,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:02 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1014,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:02 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1013,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:02 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1012,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:02 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1011,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:02 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1010,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:02 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1009,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:02 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1008,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:02 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1007,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:02 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
1006,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:02 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1005,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:02 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xb6bb    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
1004,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:02 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xb6bb   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1e8   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1003,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:02 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  DWM-1   Account Domain:  Window Manager   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1e8   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
1002,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:01 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
1001,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:01 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
1000,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:01 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
999,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:01 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
998,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:01 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
997,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:01 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
996,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:01 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
995,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:01 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
994,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:01 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-1   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon ID:  0x74e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1e8   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
993,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:01 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1e8   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
992,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:01 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-0   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon ID:  0x74d9   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1a8   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
991,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:01 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1a8   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
990,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:01 AM,4902,None,"The Per-user audit policy table was created.    Number of Elements: 0  Policy ID: 0x732e  "
989,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:01 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Logon Information:   Logon Type:  0   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  -    New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4   Process Name:  ?    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  -   Authentication Package: -   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
988,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:01 AM,4608,None,"Windows is starting up.    This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.  "
987,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:01 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x238   New Process Name: ??????????????e??? ????????? ???????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1a8   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
986,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:01 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x230   New Process Name: ????????????????-??6??8????0--?0???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1a8   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
985,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:01 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1e8   New Process Name: ????????????????-??6??0????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1a0   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
984,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:01 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1b0   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1a0   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
983,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:01 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1a8   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x154   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
982,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:01 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1a0   New Process Name: ??????????????-??6??8????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x108   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
981,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:01 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x15c   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x154   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
980,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:00 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x154   New Process Name: ??????????????-??6??8????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x108   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
979,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:00 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x11c   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x108   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
978,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:00 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x108   New Process Name: ??????????????-??6?4????0--?0???????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x4   Creator Process Name: ???????   Process Command Line: ????0--?0???????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
977,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:23:00 AM,4826,None,"Boot Configuration Data loaded.    Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    General Settings:   Load Options:  -   Advanced Options:  No     Configuration Access Policy: Default     System Event Logging: No     Kernel Debugging: No     VSM Launch Type: Off      Signature Settings:   Test Signing:  No     Flight Signing:  No     Disable Integrity Checks: No      HyperVisor Settings:   HyperVisor Load Options: -   HyperVisor Launch Type: Off     HyperVisor Debugging: No    "
976,Security,Microsoft-Windows-Eventlog,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:41 AM,1100,None,"The event logging service has shut down.  "
975,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:32 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
974,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:32 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
973,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:31 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
972,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:31 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
971,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:30 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\wbem\Win32_Tpm.dll   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
970,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:30 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Speech_OneCore\common\Windows.Speech.Shell.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
969,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:30 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Speech_OneCore\common\sapi_onecore.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
968,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\IME\IMETC\IMTCCORE.DLL   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
967,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\IME\IMEJP\IMJPAPI.DLL   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
966,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\XblAuthTokenBrokerExt.dll   Handle ID: 0x70    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
965,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\wininet.dll   Handle ID: 0x70    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
964,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Windows.Mirage.dll   Handle ID: 0x70    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
963,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\win32kfull.sys   Handle ID: 0x70    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
962,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\user32.dll   Handle ID: 0x70    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
961,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\urlmon.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
960,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\twinapi.appcore.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
959,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\TpmCoreProvisioning.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
958,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\t2embed.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
957,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\PCPKsp.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
956,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\msxml3.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
955,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\mswstr10.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
954,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\msv1_0.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
953,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\msjint40.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
952,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\mshtml.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
951,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\msexcl40.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
950,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\msctf.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
949,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\jscript9.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
948,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\jscript.dll   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
947,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\GdiPlus.dll   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
946,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\gdi32full.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
945,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\fontdrvhost.exe   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
944,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\FirewallAPI.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
943,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\edgehtml.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
942,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\dnsapi.dll   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
941,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\cryptngc.dll   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
940,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Chakradiag.dll   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
939,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Chakra.dll   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
938,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\pris\resources.en-US.pri   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
937,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\resources.pri   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
936,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\MixedRealityPortal.exe   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
935,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\AppxSignature.p7x   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
934,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\AppxManifest.xml   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
933,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\AppxBlockMap.xml   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
932,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
931,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\resources.pri   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
930,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
929,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaSpeechux.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
928,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Signals.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
927,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
926,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\AppxSignature.p7x   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
925,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\AppxManifest.xml   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
924,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\AppxBlockMap.xml   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
923,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\resources.pri   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
922,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\eModel.dll   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
921,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\EdgeContent.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
920,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\zu-ZA\SyncRes.dll.mui   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
919,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\yo-NG\SyncRes.dll.mui   Handle ID: 0x68    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
918,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\xh-ZA\SyncRes.dll.mui   Handle ID: 0x68    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
917,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\wo-SN\SyncRes.dll.mui   Handle ID: 0x68    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
916,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\wbem\Win32_Tpm.dll   Handle ID: 0x68    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
915,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\vi-VN\SyncRes.dll.mui   Handle ID: 0x68    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
914,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\uz-Latn-UZ\SyncRes.dll.mui   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
913,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ur-PK\SyncRes.dll.mui   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
912,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ug-CN\SyncRes.dll.mui   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
911,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\tt-RU\SyncRes.dll.mui   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
910,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\tn-ZA\SyncRes.dll.mui   Handle ID: 0x68    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
909,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\tk-TM\SyncRes.dll.mui   Handle ID: 0x68    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
908,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ti-ET\SyncRes.dll.mui   Handle ID: 0x68    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
907,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\tg-Cyrl-TJ\SyncRes.dll.mui   Handle ID: 0x68    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
906,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\te-IN\SyncRes.dll.mui   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
905,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ta-IN\SyncRes.dll.mui   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
904,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\sw-KE\SyncRes.dll.mui   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
903,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\sr-Cyrl-RS\SyncRes.dll.mui   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
902,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\sr-Cyrl-BA\SyncRes.dll.mui   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
901,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\sq-AL\SyncRes.dll.mui   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
900,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Speech_OneCore\common\Windows.Speech.Shell.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
899,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Speech_OneCore\common\sapi_onecore.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
898,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\si-LK\SyncRes.dll.mui   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
897,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\sd-Arab-PK\SyncRes.dll.mui   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
896,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\rw-RW\SyncRes.dll.mui   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
895,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\quz-PE\SyncRes.dll.mui   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
894,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\quc-Latn-GT\SyncRes.dll.mui   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
893,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\prs-AF\SyncRes.dll.mui   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
892,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\pa-IN\SyncRes.dll.mui   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
891,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\pa-Arab-PK\SyncRes.dll.mui   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
890,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\or-IN\SyncRes.dll.mui   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
889,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\nso-ZA\SyncRes.dll.mui   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
888,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\nn-NO\SyncRes.dll.mui   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
887,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ne-NP\SyncRes.dll.mui   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
886,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\mt-MT\SyncRes.dll.mui   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
885,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ms-MY\SyncRes.dll.mui   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
884,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\mr-IN\SyncRes.dll.mui   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
883,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\mn-MN\SyncRes.dll.mui   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
882,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ml-IN\SyncRes.dll.mui   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
881,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\mk-MK\SyncRes.dll.mui   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
880,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\mi-NZ\SyncRes.dll.mui   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
879,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\lo-LA\SyncRes.dll.mui   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
878,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\lb-LU\SyncRes.dll.mui   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
877,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ky-KG\SyncRes.dll.mui   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
876,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ku-Arab-IQ\SyncRes.dll.mui   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
875,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\kok-IN\SyncRes.dll.mui   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
874,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\kn-IN\SyncRes.dll.mui   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
873,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\km-KH\SyncRes.dll.mui   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
872,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\kk-KZ\SyncRes.dll.mui   Handle ID: 0x64    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
871,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ka-GE\SyncRes.dll.mui   Handle ID: 0x64    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
870,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\is-IS\SyncRes.dll.mui   Handle ID: 0x64    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
869,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\IME\shared\ImeBroker.exe   Handle ID: 0x64    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
868,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\IME\IMETC\IMTCCORE.DLL   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
867,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\IME\IMEJP\IMJPAPI.DLL   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
866,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ig-NG\SyncRes.dll.mui   Handle ID: 0x68    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
865,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\id-ID\SyncRes.dll.mui   Handle ID: 0x68    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
864,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\hy-AM\SyncRes.dll.mui   Handle ID: 0x68    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
863,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ha-Latn-NG\SyncRes.dll.mui   Handle ID: 0x68    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
862,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\gu-IN\SyncRes.dll.mui   Handle ID: 0x68    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
861,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\gd-GB\SyncRes.dll.mui   Handle ID: 0x68    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
860,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ga-IE\SyncRes.dll.mui   Handle ID: 0x68    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
859,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\fil-PH\SyncRes.dll.mui   Handle ID: 0x68    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
858,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\fa-IR\SyncRes.dll.mui   Handle ID: 0x68    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
857,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\en-US\TpmCoreProvisioning.dll.mui   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
856,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\en-US\CryptNgc.dll.mui   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
855,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\urscx01000.sys   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
854,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\srv2.sys   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
853,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\nwifi.sys   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
852,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\cy-GB\SyncRes.dll.mui   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
851,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\chr-CHER-US\SyncRes.dll.mui   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
850,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ca-ES-valencia\SyncRes.dll.mui   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
849,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\bs-Latn-BA\SyncRes.dll.mui   Handle ID: 0x64    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
848,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\bn-IN\SyncRes.dll.mui   Handle ID: 0x64    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
847,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\bn-BD\SyncRes.dll.mui   Handle ID: 0x64    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
846,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\be-BY\SyncRes.dll.mui   Handle ID: 0x64    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
845,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\az-Latn-AZ\SyncRes.dll.mui   Handle ID: 0x64    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
844,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\as-IN\SyncRes.dll.mui   Handle ID: 0x64    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
843,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:29 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\appraiser\appraiser.sdb   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
842,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\am-ET\SyncRes.dll.mui   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
841,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\af-ZA\SyncRes.dll.mui   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
840,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\XblAuthTokenBrokerExt.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
839,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\wlansec.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
838,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\wininet.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
837,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Windows.Mirage.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
836,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\win32kfull.sys   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
835,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\win32kbase.sys   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
834,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\user32.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
833,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\urlmon.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
832,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\twinapi.appcore.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
831,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\TpmTasks.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
830,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\TpmCoreProvisioning.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
829,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\t2embed.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
828,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\StartTileData.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
827,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\PCPKsp.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
826,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\NgcCtnr.dll   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
825,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\msxml3.dll   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
824,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\msv1_0.dll   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
823,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\mshtml.dll   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
822,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\msctf.dll   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
821,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\MPSSVC.dll   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
820,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\jscript9diag.dll   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
819,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\jscript9.dll   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
818,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\jscript.dll   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
817,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ISM.dll   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
816,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Hydrogen.dll   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
815,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\hvix64.exe   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
814,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\hvax64.exe   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
813,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\HolographicRuntimes.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
812,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\HolographicExtensions.dll   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
811,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\HologramCompositor.dll   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
810,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\GdiPlus.dll   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
809,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\gdi32full.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
808,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\fontdrvhost.exe   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
807,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\FirewallAPI.dll   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
806,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\edgehtml.dll   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
805,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\dnsapi.dll   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
804,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\DHolographicDisplay.dll   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
803,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\cryptngc.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
802,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Chakradiag.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
801,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Chakra.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
800,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\browserbroker.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
799,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\bcryptprimitives.dll   Handle ID: 0x7c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
798,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim   Handle ID: 0x7c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
797,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Boot\PCAT\qps-ploc\bootmgr.exe.mui   Handle ID: 0x7c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
796,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\apppatch\sysmain.sdb   Handle ID: 0x7c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
795,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_speech_onecore_587c58cfbeda0062.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
794,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_fe5c6d762edd2110.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
793,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_windowsholographicdevices_spatialstore_d5a1eb12b1c88209.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
792,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata_windowsholographicdevices_da35b7d83993eebe.cdf-ms   Handle ID: 0x7c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
791,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\programdata.cdf-ms   Handle ID: 0x7c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
790,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_apppatch_1143992cbbbebcab.cdf-ms   Handle ID: 0x7c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
789,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_pcat_qps-ploc_109d95b40d3e11cb.cdf-ms   Handle ID: 0x7c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
788,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_pcat_0f8924c0debe64e4.cdf-ms   Handle ID: 0x7c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
787,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_40104b85a18bfcb2.cdf-ms   Handle ID: 0x7c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
786,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_containers_serviced_07c9b2b35f82b615.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
785,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_ime_imetc_dicts_b6bb60758b345dca.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
784,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_ime_imetc_help_7cd8fd160d71b81c.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
783,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_ime_imetc_0d348c40e45e62ef.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
782,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_ime_3f581be9a4c8cabd.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
781,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_af-za_3b02d2e090436def.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
780,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_am-et_3b02f5f6904339f6.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
779,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_appraiser_59bebec9f06db09b.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
778,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_as-in_3b02e9ba90434cf6.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
777,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_az-latn-az_d54681d79b13c6b3.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
776,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_be-by_3ce9782e8d6975c7.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
775,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_bn-bd_3ce94f0c8d69b46d.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
774,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_bn-in_3ce962088d6997fa.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
773,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_bs-latn-ba_40af39211ce53ee1.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
772,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ca-es-valencia_d9502d6b71863d29.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
771,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_chr-cher-us_6d8240fe66f8158d.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
770,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_cy-gb_3ecfc14e8a900a38.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
769,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_drivers_dc1b782427b5ee1b.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
768,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_en-us_429cd25484dc6f94.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
767,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_fa-ir_448349dc8202badd.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
766,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_fil-ph_1903a37923e1edc2.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
765,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ga-ie_4669a8c87f292c7b.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
764,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_gd-gb_4669a2aa7f2935f7.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
763,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_gu-in_4669b70e7f29192e.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
762,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ha-latn-ng_1baf26f1e513ebd3.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
761,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_hy-am_48502c327c4f69dc.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
760,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_id-id_4a3695aa7975c979.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
759,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ig-ng_4a369af07975c1e6.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
758,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ime_imejp_e3d40370a148c91a.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
757,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ime_imetc_applets_6d36ac75fb0330ae.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
756,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ime_imetc_e3d3eac2a148ee29.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
755,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ime_shared_5a5b3a5824d8fee4.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
754,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_is-is_4a36b0087975a381.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
753,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ka-ge_4e03873073c25edd.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
752,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_kk-kz_4e03ada673c2263e.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
751,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_km-kh_4e038b3273c25a22.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
750,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_kn-in_4e03967273c2495b.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
749,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_kok-in_21abb62f1787fa37.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
748,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ku-arab-iq_aa126762975b3fa6.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
747,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ky-kg_4e03879c73c260c7.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
746,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_lb-lu_4fea1d0670e87e3c.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
745,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_lo-la_4fe9f53a70e8bb4d.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
744,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_logfiles_firewall_488be49cc4415d55.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
743,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_mi-nz_51d09d226e0ebed1.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
742,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_mk-mk_51d080606e0eea29.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
741,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ml-in_51d085ee6e0ee1eb.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
740,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_mn-mn_51d085a66e0ee291.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
739,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_mr-in_51d085166e0ee3d1.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
738,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ms-my_51d099d46e0ec4d3.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
737,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_mt-mt_51d090326e0ed361.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
736,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ne-np_53b702506b3526a0.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
735,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_nn-no_53b6ff266b352c52.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
734,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_nso-za_26cf1baf103efb14.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
733,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_or-in_559d744a685b7d03.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
732,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_pa-arab-pk_b9353ac876be4dc0.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
731,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_pa-in_5783ee486581c43b.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
730,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_prs-af_2abfe39d0a3ac8f9.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
729,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_quc-latn-gt_a0f0a458f1e3ef77.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
728,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_quz-pe_2c3a5d4f08542618.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
727,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_rw-rw_5b50eb7a5fce4acb.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
726,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_sd-arab-pk_51fafd0ab9789228.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
725,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_si-lk_5d374e445cf4b51c.cdf-ms   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
724,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_speech_onecore_common_60bf750299e8ab15.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
723,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_speech_onecore_voiceactivation_57f72a0344e2d398.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
722,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_sq-al_5d374f0a5cf4b4c0.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
721,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_sr-cyrl-ba_64b50c96d951cf7c.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
720,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_sr-cyrl-rs_64b5286ed951a79e.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
719,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_sw-ke_5d3740e85cf4ca9f.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
718,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ta-in_5f1dccb05a1af69f.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
717,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_te-in_5f1dcc205a1af7e3.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
716,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_tg-cyrl-tj_170697edbb9782bf.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
715,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ti-et_5f1dd6f45a1ae80d.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
714,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_tk-tm_5f1dc9625a1afcad.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
713,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_tn-za_5f1db22e5a1b1fd2.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
712,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_tt-ru_5f1dd74e5a1ae8bc.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
711,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ug-cn_6104437257414518.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
710,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ur-pk_61043c345741512b.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
709,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_uz-latn-uz_87a351ab8f888ecb.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
708,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_vi-vn_62eabac454679266.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
707,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_wbem_06656d9fdf2f8577.cdf-ms   Handle ID: 0x64    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
706,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_en-us_028e6949cac04f1d.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
705,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_3f102d555ee05d33.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
704,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_wo-sn_64d13186518de0e2.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
703,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_xh-za_66b7916e4eb45050.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
702,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_yo-ng_689e13704bda8dfe.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
701,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_zu-za_6a847ece4900ed9f.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
700,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
699,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_applicationguard_8359e7f74deb583c.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
698,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_booklibrary_3e904335483f7fff.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
697,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_bookviewer_css_38b1881b8abcd7a5.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
696,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_bookviewer_js_78c5ff49aa9e261b.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
695,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_bookviewer_990e8d61fcad5c14.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
694,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_errorpages_73ec08ffb6105e23.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
693,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_fonts_206f147a74e786c9.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
692,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_hostextensions_autoformfill_content_5091a4e29314f3d6.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
691,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_hostextensions_autoformfill_document_3a04a7fa7c0c1008.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
690,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_hostextensions_autoformfill_prefill_578958a487bb2d19.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
689,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_hostextensions_autoformfill_dcb3be839f31d5cd.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
688,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_hostextensions_learningtools_25cb263578b00eec.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
687,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_persona_4fd2132d4ad15439.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
686,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_readingview_css_3066d24b0856bea1.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
685,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_readingview_e64e82231b0e5fce.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
684,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_webnotes_febc6b7abccb2874.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
683,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_assets_f8075bc7ad02362b.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
682,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_pris_4719a634d2c04eec.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
681,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedge_8wekyb3d8bbwe_43d095bdcce4e130.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
680,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_2d6b8920d3f31e0d.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
679,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.holographicfirstrun_cw5n1h2txyewy_assets_fa2d54e2d81dc483.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
678,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.holographicfirstrun_cw5n1h2txyewy_pris_960a16f2012eced2.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
677,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.holographicfirstrun_cw5n1h2txyewy_dabe890a6e455bec.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
676,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_af-za_96bd6b3c83001e43.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
675,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_am-et_96bd8e5282ffea4a.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
674,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_as-in_96bd821682fffd4a.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
673,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_az-latn-az_94ea7e29ba269939.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
672,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_be-by_98a4108a8026261b.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
671,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_bn-bd_98a3e768802664c1.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
670,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_bn-in_98a3fa648026484e.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
669,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_bs-latn-ba_005335733bf81167.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
668,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ca-es-valencia_fe992de7e9ae0c23.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
667,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_chr-cher-us_65aa97cf07b750c1.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
666,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_cy-gb_9a8a59aa7d4cba8c.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
665,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_en-us_9e576ab077991fe8.cdf-ms   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
664,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_fa-ir_a03de23874bf6b31.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
663,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_fil-ph_3ffbcbfd8d5419bc.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
662,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ga-ie_a224412471e5dccf.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
661,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_gd-gb_a2243b0671e5e64b.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
660,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_gu-in_a2244f6a71e5c982.cdf-ms   Handle ID: 0x78    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
659,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ha-latn-ng_db5323440426be59.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
658,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_hy-am_a40ac48e6f0c1a30.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
657,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_id-id_a5f12e066c3279cd.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
656,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ig-ng_a5f1334c6c32723a.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
655,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ime_imejp_0f2986100e0c2dc6.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
654,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ime_imetc_applets_4cc083d5c906ff5a.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
653,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ime_imetc_0f296d620e0c52d5.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
652,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_is-is_a5f148646c3253d5.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
651,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ka-ge_a9be1f8c667f0f31.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
650,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_kk-kz_a9be4602667ed692.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
649,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_km-kh_a9be238e667f0a76.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
648,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_kn-in_a9be2ece667ef9af.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
647,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_kok-in_48a3deb380fa2631.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
646,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:28 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ku-arab-iq_69b663b4b66e122c.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
645,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ky-kg_a9be1ff8667f111b.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
644,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_lb-lu_aba4b56263a52e90.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
643,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_lo-la_aba48d9663a56ba1.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
642,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_logfiles_lsa_5371ea7113e5392b.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
641,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_mi-nz_ad8b357e60cb6f25.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
640,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_mk-mk_ad8b18bc60cb9a7d.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
639,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ml-in_ad8b1e4a60cb923f.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
638,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_mn-mn_ad8b1e0260cb92e5.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
637,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_mr-in_ad8b1d7260cb9425.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
636,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ms-my_ad8b323060cb7527.cdf-ms   Handle ID: 0x7c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
635,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_mt-mt_ad8b288e60cb83b5.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
634,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ne-np_af719aac5df1d6f4.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
633,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_nn-no_af7197825df1dca6.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
632,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_nso-za_4dc7443379b1270e.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
631,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_or-in_b1580ca65b182d57.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
630,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_pa-arab-pk_78d9371a95d12046.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
629,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_pa-in_b33e86a4583e748f.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
628,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_prs-af_51b80c2173acf4f3.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
627,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_quc-latn-gt_9918fb2992a32aab.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
626,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_quz-pe_533285d371c65212.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
625,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_rw-rw_b70b83d6528afb1f.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
624,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_sd-arab-pk_119ef95cd88b64ae.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
623,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_si-lk_b8f1e6a04fb16570.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
622,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_speech_onecore_common_3ac1627a1b848769.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
621,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_speech_onecore_voiceactivation_64af56b9bf516892.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
620,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_sq-al_b8f1e7664fb16514.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
619,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_sr-cyrl-ba_245908e8f864a202.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
618,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_sr-cyrl-rs_245924c0f8647a24.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
617,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_sw-ke_b8f1d9444fb17af3.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
616,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ta-in_bad8650c4cd7a6f3.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
615,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_te-in_bad8647c4cd7a837.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
614,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_tg-cyrl-tj_d6aa943fdaaa5545.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
613,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ti-et_bad86f504cd79861.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
612,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_tk-tm_bad861be4cd7ad01.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
611,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_tn-za_bad84a8a4cd7d026.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
610,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_tt-ru_bad86faa4cd79910.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
609,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ug-cn_bcbedbce49fdf56c.cdf-ms   Handle ID: 0x84    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
608,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ur-pk_bcbed49049fe017f.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
607,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_uz-latn-uz_47474dfdae9b6151.cdf-ms   Handle ID: 0x7c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
606,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_vi-vn_bea55320472442ba.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
605,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_wbem_1bf25d11bb30b33f.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
604,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_en-us_79e30ca972b850e5.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
603,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_19ae85881f1c4f2d.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
602,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_wo-sn_c08bc9e2444a9136.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
601,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_xh-za_c27229ca417100a4.cdf-ms   Handle ID: 0x74    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
600,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_yo-ng_c458abcc3e973e52.cdf-ms   Handle ID: 0x7c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
599,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_zu-za_c63f172a3bbd9df3.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
598,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_21ffbdd2a2dd92e0.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
597,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$.cdf-ms   Handle ID: 0x7c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
596,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\_0000000000000000.cdf-ms   Handle ID: 0x70    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
595,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\sspicli.dll   Handle ID: 0x70    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
594,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\storport.sys   Handle ID: 0x7c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
593,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\ntfs.sys   Handle ID: 0x7c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
592,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\mrxsmb20.sys   Handle ID: 0x7c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
591,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\ksecdd.sys   Handle ID: 0x7c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
590,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\dxgkrnl.sys   Handle ID: 0x70    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
589,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\cng.sys   Handle ID: 0x70    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
588,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\drivers\clfs.sys   Handle ID: 0x70    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
587,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\sspisrv.dll   Handle ID: 0x70    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
586,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\sspicli.dll   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
585,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\ntoskrnl.exe   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
584,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\lsasrv.dll   Handle ID: 0x6c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
583,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Boot\PCAT\bootmgr   Handle ID: 0x5c    Process Information:   Process ID: 0x13cc   Process Name: C:\Windows\System32\poqexec.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
582,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:03 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
581,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:03 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
580,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:03 AM,4647,None,"User initiated logoff:    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x23502    This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.  "
579,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:03 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
578,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:22:03 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
577,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:27 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xaa0   Process Name:  C:\Windows\System32\VSSVC.exe  "
576,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:27 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xaa0   Process Name:  C:\Windows\System32\VSSVC.exe  "
575,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:27 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xaa0   Process Name:  C:\Windows\System32\VSSVC.exe  "
574,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:27 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xaa0   Process Name:  C:\Windows\System32\VSSVC.exe  "
573,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:27 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xaa0   Process Name:  C:\Windows\System32\VSSVC.exe  "
572,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:27 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xaa0   Process Name:  C:\Windows\System32\VSSVC.exe  "
571,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:27 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
570,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
569,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:27 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xaa0   Process Name:  C:\Windows\System32\VSSVC.exe  "
568,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:27 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xaa0   Process Name:  C:\Windows\System32\VSSVC.exe  "
567,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:27 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
566,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
565,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Macromed\Flash\FlashUtil_ActiveX.exe   Handle ID: 0x178    Process Information:   Process ID: 0xa40   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
564,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Macromed\Flash\FlashUtil_ActiveX.dll   Handle ID: 0x104    Process Information:   Process ID: 0xa40   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
563,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Macromed\Flash\Flash.ocx   Handle ID: 0x520    Process Information:   Process ID: 0xa40   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
562,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\SysWOW64\Macromed\Flash\activex.vch   Handle ID: 0x4e8    Process Information:   Process ID: 0xa40   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
561,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe   Handle ID: 0x178    Process Information:   Process ID: 0xa40   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
560,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.dll   Handle ID: 0x518    Process Information:   Process ID: 0xa40   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
559,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Macromed\Flash\Flash.ocx   Handle ID: 0x104    Process Information:   Process ID: 0xa40   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
558,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\System32\Macromed\Flash\activex.vch   Handle ID: 0x520    Process Information:   Process ID: 0xa40   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: S:AI   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
557,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_macromed_flash_5ff3bc7496f0271e.cdf-ms   Handle ID: 0x4e8    Process Information:   Process ID: 0xa40   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
556,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms   Handle ID: 0x104    Process Information:   Process ID: 0xa40   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
555,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_macromed_flash_853cbcf10f17f618.cdf-ms   Handle ID: 0x520    Process Information:   Process ID: 0xa40   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
554,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_21ffbdd2a2dd92e0.cdf-ms   Handle ID: 0x51c    Process Information:   Process ID: 0xa40   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
553,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\$$.cdf-ms   Handle ID: 0x518    Process Information:   Process ID: 0xa40   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
552,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:27 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\WinSxS\FileMaps\_0000000000000000.cdf-ms   Handle ID: 0x520    Process Information:   Process ID: 0xa40   Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.15_none_2c4b8d3b386eed8e\TiWorker.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;0x1f0116;;;WD)  "
551,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:22 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
550,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:20:22 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
549,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:19:50 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
548,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:19:50 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
547,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:19:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
546,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:19:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
545,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:18:27 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
544,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:18:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
543,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:17:12 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
542,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:17:12 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
541,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:16:46 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x121c   Process Name:  C:\Windows\System32\svchost.exe  "
540,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:16:46 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x121c   Process Name:  C:\Windows\System32\svchost.exe  "
539,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:16:43 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
538,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:16:43 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
537,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:15:54 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
536,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:15:54 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
535,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:15:24 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
534,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:15:24 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
533,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:15:20 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
532,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:15:20 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
531,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:15:11 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
530,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:15:11 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
529,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:15:00 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
528,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:15:00 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
527,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:59 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x23502    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x43c   Process Name:  C:\Windows\System32\svchost.exe  "
526,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:58 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x1578   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
525,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:58 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x1578   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
524,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:57 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
523,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:57 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
522,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:57 AM,4726,None,"A user account was deleted.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x23502    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1001   Account Name:  defaultuser0   Account Domain:  MSEDGEWIN10    Additional Information:   Privileges -  "
521,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:57 AM,4729,None,"A member was removed from a security-enabled global group.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x23502    Member:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1001   Account Name:  -    Group:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-513   Group Name:  None   Group Domain:  MSEDGEWIN10    Additional Information:   Privileges:  -  "
520,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:57 AM,4733,None,"A member was removed from a security-enabled local group.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x23502    Member:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1001   Account Name:  -    Group:   Security ID:  S-1-5-32-545   Group Name:  Users   Group Domain:  Builtin    Additional Information:   Privileges:  -  "
519,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:56 AM,5059,None,"Key migration operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Additional Information:   Operation: Export of persistent cryptographic key.     Return Code: 0x0  "
518,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:56 AM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
517,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:56 AM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Key File Operation Information:   File Path: C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
516,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:55 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
515,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:55 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
514,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:55 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
513,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:55 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
512,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:54 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
511,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:54 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
510,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:53 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
509,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:53 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
508,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:52 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
507,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:52 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
506,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:52 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
505,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:52 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
504,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:52 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x43c   Process Name:  C:\Windows\System32\svchost.exe  "
503,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:52 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
502,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:52 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
501,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:51 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
500,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:51 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
499,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:51 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x23502    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
498,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:51 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0x23502   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x518   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
497,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:51 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x518   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
496,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:50 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x8b4   Process Name:  C:\Windows\System32\svchost.exe  "
495,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:50 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x8b4   Process Name:  C:\Windows\System32\svchost.exe  "
494,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:50 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
493,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:50 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
492,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:50 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
491,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:50 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
490,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:50 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
489,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:50 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
488,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:50 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
487,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:50 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
486,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:50 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
485,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:50 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
484,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:49 AM,5024,None,"The Windows Firewall service started successfully.  "
483,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:49 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x3a8   Process Name:  C:\Windows\System32\LogonUI.exe  "
482,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x8ac   Process Name:  C:\Windows\System32\svchost.exe  "
481,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:49 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x8ac   Process Name:  C:\Windows\System32\svchost.exe  "
480,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
479,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
478,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
477,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
476,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
475,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
474,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
473,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
472,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
471,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
470,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
469,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
468,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
467,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
466,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
465,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
464,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:48 AM,5033,None,"The Windows Firewall Driver started successfully.  "
463,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:48 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
462,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:48 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
461,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:48 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
460,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:48 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
459,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:48 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
458,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:48 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
457,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:48 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
456,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:48 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
455,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:48 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
454,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:48 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
453,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
452,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
451,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
450,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
449,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
448,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
447,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbbee    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
446,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xbbee   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1e8   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
445,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  DWM-1   Account Domain:  Window Manager   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1e8   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
444,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
443,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
442,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
441,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
440,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
439,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
438,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
437,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x230   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
436,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-0   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon ID:  0x7417   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1a8   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
435,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1a8   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
434,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-1   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon ID:  0x7426   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1e8   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
433,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1e8   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
432,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4902,None,"The Per-user audit policy table was created.    Number of Elements: 0  Policy ID: 0x727a  "
431,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Logon Information:   Logon Type:  0   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  -    New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4   Process Name:  ?    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  -   Authentication Package: -   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
430,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4608,None,"Windows is starting up.    This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.  "
429,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x238   New Process Name: ??????????????e??? ????????? ???????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1a8   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
428,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x230   New Process Name: ????????????????-??6??8????0--?0???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1a8   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
427,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1e8   New Process Name: ????????????????-??6??0????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1a0   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
426,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1b0   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1a0   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
425,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1a8   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x154   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
424,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:47 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1a0   New Process Name: ??????????????-??6??c????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x10c   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
423,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:46 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x15c   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x154   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
422,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:46 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x154   New Process Name: ??????????????-??6??c????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x10c   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
421,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:46 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x120   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x10c   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
420,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:45 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x10c   New Process Name: ??????????????-??6?4????0--?0???????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x4   Creator Process Name: ???????   Process Command Line: ????0--?0???????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
419,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:45 AM,4826,None,"Boot Configuration Data loaded.    Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    General Settings:   Load Options:  -   Advanced Options:  No     Configuration Access Policy: Default     System Event Logging: No     Kernel Debugging: No     VSM Launch Type: Off      Signature Settings:   Test Signing:  No     Flight Signing:  No     Disable Integrity Checks: No      HyperVisor Settings:   HyperVisor Load Options: -   HyperVisor Launch Type: Off     HyperVisor Debugging: No    "
418,Security,Microsoft-Windows-Eventlog,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:33 AM,1100,None,"The event logging service has shut down.  "
417,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:32 AM,4647,None,"User initiated logoff:    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xa3732    This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.  "
416,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:31 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
415,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:31 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
414,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:27 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
413,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
412,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:26 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
411,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:26 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
410,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:16 AM,4738,None,"A user account was changed.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xa3732    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Changed Attributes:   SAM Account Name: IEUser   Display Name:  IEUser   User Principal Name: -   Home Directory:  <value not set>     Home Drive:  <value not set>     Script Path:  <value not set>     Profile Path:  <value not set>     User Workstations: <value not set>     Password Last Set: 10/17/2017 11:13:19 AM   Account Expires:  <never>     Primary Group ID: 513   AllowedToDelegateTo: -   Old UAC Value:  0x10   New UAC Value:  0x210   User Account Control:     'Don't Expire Password' - Enabled     User Parameters: <value not set>     SID History:  -   Logon Hours:  All      Additional Information:   Privileges:  -  "
409,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:16 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xa3732    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xd80   Process Name:  C:\Windows\System32\wbem\WmiPrvSE.exe  "
408,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:16 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xa3732    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0xd80   Process Name:  C:\Windows\System32\wbem\WmiPrvSE.exe  "
407,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:08 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
406,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:08 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
405,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:05 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
404,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:14:05 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
403,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:53 AM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
402,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:53 AM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Key File Operation Information:   File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\cd455911c6bd0dcc9201580bceecbda5_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
401,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:52 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
400,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:52 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
399,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:52 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x6d0   Process Name:  C:\Windows\System32\svchost.exe  "
398,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:51 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xa3732    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
397,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:51 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon ID:  0xa3732   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x8a8   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
396,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:51 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  IEUser   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x8a8   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
395,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:51 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-2   Account Name:  DWM-2   Account Domain:  Window Manager   Logon ID:  0xa24e4    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
394,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:51 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-2   Account Name:  DWM-2   Account Domain:  Window Manager   Logon ID:  0xa24e4   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1ba8   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
393,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:51 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  DWM-2   Account Domain:  Window Manager   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1ba8   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
392,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:51 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-2   Account Name:  UMFD-2   Account Domain:  Font Driver Host   Logon ID:  0xa20c5   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1ba8   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
391,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:51 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-2   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1ba8   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
390,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:51 AM,4634,None,"An account was logged off.    Subject:   Security ID:  S-1-5-96-0-1   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon ID:  0x7463    Logon Type:   2    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.  "
389,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:51 AM,4634,None,"An account was logged off.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xba9d    Logon Type:   2    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.  "
388,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:50 AM,4647,None,"User initiated logoff:    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1001   Account Name:  defaultuser0   Account Domain:  MSEDGEWIN10   Logon ID:  0x37790    This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.  "
387,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:50 AM,4733,None,"A member was removed from a security-enabled local group.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Member:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1001   Account Name:  -    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Additional Information:   Privileges:  -  "
386,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:50 AM,4738,None,"A user account was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1001   Account Name:  defaultuser0   Account Domain:  MSEDGEWIN10    Changed Attributes:   SAM Account Name: defaultuser0   Display Name:  <value not set>     User Principal Name: -   Home Directory:  <value not set>     Home Drive:  <value not set>     Script Path:  <value not set>     Profile Path:  <value not set>     User Workstations: <value not set>     Password Last Set: 10/17/2017 11:13:21 AM   Account Expires:  <never>     Primary Group ID: 513   AllowedToDelegateTo: -   Old UAC Value:  0x214   New UAC Value:  0x211   User Account Control:     Account Disabled      'Password Not Required' - Disabled     User Parameters: <value not set>     SID History:  -   Logon Hours:  All      Additional Information:   Privileges:  -  "
385,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:50 AM,4725,None,"A user account was disabled.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1001   Account Name:  defaultuser0   Account Domain:  MSEDGEWIN10  "
384,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:41 AM,5059,None,"Key migration operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Additional Information:   Operation: Export of persistent cryptographic key.     Return Code: 0x0  "
383,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:41 AM,5059,None,"Key migration operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Additional Information:   Operation: Export of persistent cryptographic key.     Return Code: 0x0  "
382,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:41 AM,5059,None,"Key migration operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Additional Information:   Operation: Export of persistent cryptographic key.     Return Code: 0x0  "
381,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:41 AM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
380,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:41 AM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Key File Operation Information:   File Path: C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
379,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:41 AM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Cryptographic Operation:   Operation: Create Key.     Return Code: 0x0  "
378,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:41 AM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: ECDSA_P256   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Key File Operation Information:   File Path: C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Write persisted key to file.     Return Code: 0x0  "
377,Security,Microsoft-Windows-Security-Auditing,FAILURE AUDIT,MSEDGEWIN10,10/17/2017 10:13:41 AM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x80090016  "
376,Security,Microsoft-Windows-Security-Auditing,FAILURE AUDIT,MSEDGEWIN10,10/17/2017 10:13:41 AM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x80090016  "
375,Security,Microsoft-Windows-Security-Auditing,FAILURE AUDIT,MSEDGEWIN10,10/17/2017 10:13:41 AM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: Microsoft Connected Devices Platform device certificate   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x80090016  "
374,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:40 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
373,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:40 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
372,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:37 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
371,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:37 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
370,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:35 AM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
369,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:35 AM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Key File Operation Information:   File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\cd455911c6bd0dcc9201580bceecbda5_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
368,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:35 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
367,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:35 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
366,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:35 AM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
365,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:35 AM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Key File Operation Information:   File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\cd455911c6bd0dcc9201580bceecbda5_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
364,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:34 AM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
363,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:34 AM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Key File Operation Information:   File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\cd455911c6bd0dcc9201580bceecbda5_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
362,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:33 AM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
361,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:33 AM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Key File Operation Information:   File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\cd455911c6bd0dcc9201580bceecbda5_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
360,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:33 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
359,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:33 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
358,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:32 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
357,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:32 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
356,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:32 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
355,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:32 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
354,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:31 AM,5059,None,"Key migration operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Additional Information:   Operation: Export of persistent cryptographic key.     Return Code: 0x0  "
353,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:31 AM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Cryptographic Operation:   Operation: Open Key.     Return Code: 0x0  "
352,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:31 AM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: UNKNOWN   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Key File Operation Information:   File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\cd455911c6bd0dcc9201580bceecbda5_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Read persisted key from file.     Return Code: 0x0  "
351,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:31 AM,5061,None,"Cryptographic operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Cryptographic Operation:   Operation: Create Key.     Return Code: 0x0  "
350,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:31 AM,5058,None,"Key file operation.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Cryptographic Parameters:   Provider Name: Microsoft Software Key Storage Provider   Algorithm Name: RSA   Key Name: 3f907bcb-37ed-8c9c-ed03-c24535e6cc05   Key Type: User key.      Key File Operation Information:   File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\cd455911c6bd0dcc9201580bceecbda5_e3f2d3f8-5740-4971-9eb0-9044a81a7fd5   Operation: Write persisted key to file.     Return Code: 0x0  "
349,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:30 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
348,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:30 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
347,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:30 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x6d0   Process Name:  C:\Windows\System32\svchost.exe  "
346,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:30 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1001   Account Name:  defaultuser0   Account Domain:  MSEDGEWIN10   Logon ID:  0x37790    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
345,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:30 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1001   Account Name:  defaultuser0   Account Domain:  MSEDGEWIN10   Logon ID:  0x37790   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x8a8   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
344,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:30 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  defaultuser0   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x8a8   Process Name:  C:\Windows\System32\svchost.exe    Network Information:   Network Address: 127.0.0.1   Port:   0    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
343,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:29 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
342,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:29 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
341,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:29 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
340,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:29 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
339,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:27 AM,4616,None,"The system time was changed.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Process Information:   Process ID: 0x5a4   Name:  C:\Windows\System32\svchost.exe    Previous Time:  2017-10-17T18:13:27.699596200Z  New Time:  2017-10-17T18:13:27.699516700Z    This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.  "
338,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:27 AM,4634,None,"An account was logged off.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1001   Account Name:  defaultuser0   Account Domain:  MSEDGEWIN10   Logon ID:  0x16a21    Logon Type:   2    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.  "
337,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:27 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x6d0   Process Name:  C:\Windows\System32\svchost.exe  "
336,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:27 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
335,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
334,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:25 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0xabc   Process Name:  C:\Windows\System32\svchost.exe  "
333,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:25 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0xabc   Process Name:  C:\Windows\System32\svchost.exe  "
332,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:25 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
331,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:25 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
330,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:24 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Temp\winre\ExtractedFromWim   Handle ID: 0x9b0    Process Information:   Process ID: 0x450   Process Name: C:\Windows\System32\oobe\msoobe.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
329,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:24 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
328,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:24 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
327,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:24 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
326,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:24 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
325,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:24 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
324,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:24 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
323,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:24 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
322,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:24 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
321,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:24 AM,5024,None,"The Windows Firewall service started successfully.  "
320,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:24 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
319,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:24 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
318,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:24 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
317,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:24 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
316,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:24 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
315,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:24 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
314,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:24 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
313,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:24 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
312,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:24 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
311,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:24 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
310,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:24 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
309,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:24 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
308,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:24 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
307,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:24 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
306,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:23 AM,5033,None,"The Windows Firewall Driver started successfully.  "
305,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:23 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
304,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:23 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
303,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:23 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
302,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:23 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
301,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:23 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
300,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:23 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
299,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:23 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
298,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:23 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
297,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:22 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
296,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:22 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
295,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:22 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
294,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:22 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
293,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:22 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
292,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:22 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
291,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4737,None,"A security-enabled global group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-513   Group Name:  None   Group Domain:  MSEDGEWIN10    Changed Attributes:   SAM Account Name: None   SID History:  -    Additional Information:   Privileges:  -  "
290,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4781,None,"The name of an account was changed:    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-513   Account Domain:  MSEDGEWIN10   Old Account Name: None   New Account Name: None    Additional Information:   Privileges:  -  "
289,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4737,None,"A security-enabled global group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-513   Group Name:  None   Group Domain:  MSEDGEWIN10    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
288,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4738,None,"A user account was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-504   Account Name:  WDAGUtilityAccount   Account Domain:  MSEDGEWIN10    Changed Attributes:   SAM Account Name: WDAGUtilityAccount   Display Name:  <value not set>     User Principal Name: -   Home Directory:  <value not set>     Home Drive:  <value not set>     Script Path:  <value not set>     Profile Path:  <value not set>     User Workstations: <value not set>     Password Last Set: 10/17/2017 11:11:26 AM   Account Expires:  <never>     Primary Group ID: 513   AllowedToDelegateTo: -   Old UAC Value:  0x11   New UAC Value:  0x11   User Account Control: -   User Parameters: <value not set>     SID History:  -   Logon Hours:  All      Additional Information:   Privileges:  -  "
287,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4738,None,"A user account was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-504   Account Name:  WDAGUtilityAccount   Account Domain:  MSEDGEWIN10    Changed Attributes:   SAM Account Name: WDAGUtilityAccount   Display Name:  <value not set>     User Principal Name: -   Home Directory:  <value not set>     Home Drive:  <value not set>     Script Path:  <value not set>     Profile Path:  <value not set>     User Workstations: <value not set>     Password Last Set: 10/17/2017 11:11:26 AM   Account Expires:  <never>     Primary Group ID: 513   AllowedToDelegateTo: -   Old UAC Value:  0x11   New UAC Value:  0x11   User Account Control: -   User Parameters: <value not set>     SID History:  -   Logon Hours:  All      Additional Information:   Privileges:  -  "
286,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4738,None,"A user account was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-503   Account Name:  DefaultAccount   Account Domain:  MSEDGEWIN10    Changed Attributes:   SAM Account Name: DefaultAccount   Display Name:  <value not set>     User Principal Name: -   Home Directory:  <value not set>     Home Drive:  <value not set>     Script Path:  <value not set>     Profile Path:  <value not set>     User Workstations: <value not set>     Password Last Set: <never>     Account Expires:  <never>     Primary Group ID: 513   AllowedToDelegateTo: -   Old UAC Value:  0x215   New UAC Value:  0x215   User Account Control: -   User Parameters: <value not set>     SID History:  -   Logon Hours:  All      Additional Information:   Privileges:  -  "
285,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4738,None,"A user account was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-503   Account Name:  DefaultAccount   Account Domain:  MSEDGEWIN10    Changed Attributes:   SAM Account Name: DefaultAccount   Display Name:  <value not set>     User Principal Name: -   Home Directory:  <value not set>     Home Drive:  <value not set>     Script Path:  <value not set>     Profile Path:  <value not set>     User Workstations: <value not set>     Password Last Set: <never>     Account Expires:  <never>     Primary Group ID: 513   AllowedToDelegateTo: -   Old UAC Value:  0x215   New UAC Value:  0x215   User Account Control: -   User Parameters: <value not set>     SID History:  -   Logon Hours:  All      Additional Information:   Privileges:  -  "
284,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4738,None,"A user account was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-501   Account Name:  Guest   Account Domain:  MSEDGEWIN10    Changed Attributes:   SAM Account Name: Guest   Display Name:  <value not set>     User Principal Name: -   Home Directory:  <value not set>     Home Drive:  <value not set>     Script Path:  <value not set>     Profile Path:  <value not set>     User Workstations: <value not set>     Password Last Set: <never>     Account Expires:  <never>     Primary Group ID: 513   AllowedToDelegateTo: -   Old UAC Value:  0x215   New UAC Value:  0x215   User Account Control: -   User Parameters: <value not set>     SID History:  -   Logon Hours:  All      Additional Information:   Privileges:  -  "
283,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4738,None,"A user account was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-501   Account Name:  Guest   Account Domain:  MSEDGEWIN10    Changed Attributes:   SAM Account Name: Guest   Display Name:  <value not set>     User Principal Name: -   Home Directory:  <value not set>     Home Drive:  <value not set>     Script Path:  <value not set>     Profile Path:  <value not set>     User Workstations: <value not set>     Password Last Set: <never>     Account Expires:  <never>     Primary Group ID: 513   AllowedToDelegateTo: -   Old UAC Value:  0x215   New UAC Value:  0x215   User Account Control: -   User Parameters: <value not set>     SID History:  -   Logon Hours:  All      Additional Information:   Privileges:  -  "
282,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4738,None,"A user account was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-500   Account Name:  Administrator   Account Domain:  MSEDGEWIN10    Changed Attributes:   SAM Account Name: Administrator   Display Name:  <value not set>     User Principal Name: -   Home Directory:  <value not set>     Home Drive:  <value not set>     Script Path:  <value not set>     Profile Path:  <value not set>     User Workstations: <value not set>     Password Last Set: 10/17/2017 11:13:19 AM   Account Expires:  <never>     Primary Group ID: 513   AllowedToDelegateTo: -   Old UAC Value:  0x211   New UAC Value:  0x211   User Account Control: -   User Parameters: <value not set>     SID History:  -   Logon Hours:  All      Additional Information:   Privileges:  -  "
281,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4738,None,"A user account was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-500   Account Name:  Administrator   Account Domain:  MSEDGEWIN10    Changed Attributes:   SAM Account Name: Administrator   Display Name:  <value not set>     User Principal Name: -   Home Directory:  <value not set>     Home Drive:  <value not set>     Script Path:  <value not set>     Profile Path:  <value not set>     User Workstations: <value not set>     Password Last Set: 10/17/2017 11:13:19 AM   Account Expires:  <never>     Primary Group ID: 513   AllowedToDelegateTo: -   Old UAC Value:  0x211   New UAC Value:  0x211   User Account Control: -   User Parameters: <value not set>     SID History:  -   Logon Hours:  All      Additional Information:   Privileges:  -  "
280,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-581   Group Name:  System Managed Accounts Group   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: System Managed Accounts Group   SID History:  -    Additional Information:   Privileges:  -  "
279,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4781,None,"The name of an account was changed:    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-32-581   Account Domain:  Builtin   Old Account Name: System Managed Accounts Group   New Account Name: System Managed Accounts Group    Additional Information:   Privileges:  -  "
278,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-581   Group Name:  System Managed Accounts Group   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
277,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-580   Group Name:  Remote Management Users   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: Remote Management Users   SID History:  -    Additional Information:   Privileges:  -  "
276,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4781,None,"The name of an account was changed:    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-32-580   Account Domain:  Builtin   Old Account Name: Remote Management Users   New Account Name: Remote Management Users    Additional Information:   Privileges:  -  "
275,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-580   Group Name:  Remote Management Users   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
274,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-579   Group Name:  Access Control Assistance Operators   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: Access Control Assistance Operators   SID History:  -    Additional Information:   Privileges:  -  "
273,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4781,None,"The name of an account was changed:    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-32-579   Account Domain:  Builtin   Old Account Name: Access Control Assistance Operators   New Account Name: Access Control Assistance Operators    Additional Information:   Privileges:  -  "
272,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-579   Group Name:  Access Control Assistance Operators   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
271,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-578   Group Name:  Hyper-V Administrators   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: Hyper-V Administrators   SID History:  -    Additional Information:   Privileges:  -  "
270,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4781,None,"The name of an account was changed:    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-32-578   Account Domain:  Builtin   Old Account Name: Hyper-V Administrators   New Account Name: Hyper-V Administrators    Additional Information:   Privileges:  -  "
269,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-578   Group Name:  Hyper-V Administrators   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
268,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-573   Group Name:  Event Log Readers   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: Event Log Readers   SID History:  -    Additional Information:   Privileges:  -  "
267,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4781,None,"The name of an account was changed:    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-32-573   Account Domain:  Builtin   Old Account Name: Event Log Readers   New Account Name: Event Log Readers    Additional Information:   Privileges:  -  "
266,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-573   Group Name:  Event Log Readers   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
265,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-569   Group Name:  Cryptographic Operators   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: Cryptographic Operators   SID History:  -    Additional Information:   Privileges:  -  "
264,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4781,None,"The name of an account was changed:    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-32-569   Account Domain:  Builtin   Old Account Name: Cryptographic Operators   New Account Name: Cryptographic Operators    Additional Information:   Privileges:  -  "
263,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-569   Group Name:  Cryptographic Operators   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
262,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-568   Group Name:  IIS_IUSRS   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: IIS_IUSRS   SID History:  -    Additional Information:   Privileges:  -  "
261,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4781,None,"The name of an account was changed:    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-32-568   Account Domain:  Builtin   Old Account Name: IIS_IUSRS   New Account Name: IIS_IUSRS    Additional Information:   Privileges:  -  "
260,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-568   Group Name:  IIS_IUSRS   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
259,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-562   Group Name:  Distributed COM Users   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: Distributed COM Users   SID History:  -    Additional Information:   Privileges:  -  "
258,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4781,None,"The name of an account was changed:    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-32-562   Account Domain:  Builtin   Old Account Name: Distributed COM Users   New Account Name: Distributed COM Users    Additional Information:   Privileges:  -  "
257,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-562   Group Name:  Distributed COM Users   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
256,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-559   Group Name:  Performance Log Users   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: Performance Log Users   SID History:  -    Additional Information:   Privileges:  -  "
255,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4781,None,"The name of an account was changed:    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-32-559   Account Domain:  Builtin   Old Account Name: Performance Log Users   New Account Name: Performance Log Users    Additional Information:   Privileges:  -  "
254,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-559   Group Name:  Performance Log Users   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
253,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-558   Group Name:  Performance Monitor Users   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: Performance Monitor Users   SID History:  -    Additional Information:   Privileges:  -  "
252,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4781,None,"The name of an account was changed:    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-32-558   Account Domain:  Builtin   Old Account Name: Performance Monitor Users   New Account Name: Performance Monitor Users    Additional Information:   Privileges:  -  "
251,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-558   Group Name:  Performance Monitor Users   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
250,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-547   Group Name:  Power Users   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: Power Users   SID History:  -    Additional Information:   Privileges:  -  "
249,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4781,None,"The name of an account was changed:    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-32-547   Account Domain:  Builtin   Old Account Name: Power Users   New Account Name: Power Users    Additional Information:   Privileges:  -  "
248,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-547   Group Name:  Power Users   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
247,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-556   Group Name:  Network Configuration Operators   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: Network Configuration Operators   SID History:  -    Additional Information:   Privileges:  -  "
246,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4781,None,"The name of an account was changed:    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-32-556   Account Domain:  Builtin   Old Account Name: Network Configuration Operators   New Account Name: Network Configuration Operators    Additional Information:   Privileges:  -  "
245,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-556   Group Name:  Network Configuration Operators   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
244,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-555   Group Name:  Remote Desktop Users   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: Remote Desktop Users   SID History:  -    Additional Information:   Privileges:  -  "
243,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4781,None,"The name of an account was changed:    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-32-555   Account Domain:  Builtin   Old Account Name: Remote Desktop Users   New Account Name: Remote Desktop Users    Additional Information:   Privileges:  -  "
242,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-555   Group Name:  Remote Desktop Users   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
241,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-552   Group Name:  Replicator   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: Replicator   SID History:  -    Additional Information:   Privileges:  -  "
240,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4781,None,"The name of an account was changed:    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-32-552   Account Domain:  Builtin   Old Account Name: Replicator   New Account Name: Replicator    Additional Information:   Privileges:  -  "
239,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-552   Group Name:  Replicator   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
238,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: Backup Operators   SID History:  -    Additional Information:   Privileges:  -  "
237,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4781,None,"The name of an account was changed:    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-32-551   Account Domain:  Builtin   Old Account Name: Backup Operators   New Account Name: Backup Operators    Additional Information:   Privileges:  -  "
236,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
235,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-546   Group Name:  Guests   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: Guests   SID History:  -    Additional Information:   Privileges:  -  "
234,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4781,None,"The name of an account was changed:    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-32-546   Account Domain:  Builtin   Old Account Name: Guests   New Account Name: Guests    Additional Information:   Privileges:  -  "
233,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-546   Group Name:  Guests   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
232,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-545   Group Name:  Users   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: Users   SID History:  -    Additional Information:   Privileges:  -  "
231,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4781,None,"The name of an account was changed:    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-32-545   Account Domain:  Builtin   Old Account Name: Users   New Account Name: Users    Additional Information:   Privileges:  -  "
230,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-545   Group Name:  Users   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
229,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: Administrators   SID History:  -    Additional Information:   Privileges:  -  "
228,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4781,None,"The name of an account was changed:    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-32-544   Account Domain:  Builtin   Old Account Name: Administrators   New Account Name: Administrators    Additional Information:   Privileges:  -  "
227,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
226,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1001   Account Name:  defaultuser0   Account Domain:  MSEDGEWIN10   Logon ID:  0x16a21    Privileges:  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
225,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1001   Account Name:  defaultuser0   Account Domain:  MSEDGEWIN10   Logon ID:  0x16a21   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x450   Process Name:  C:\Windows\System32\oobe\msoobe.exe    Network Information:   Workstation Name: MSEDGEWIN10   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
224,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  defaultuser0   Account Domain:  MSEDGEWIN10   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x450   Process Name:  C:\Windows\System32\oobe\msoobe.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
223,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x450   Process Name:  C:\Windows\System32\oobe\msoobe.exe  "
222,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x450   Process Name:  C:\Windows\System32\oobe\msoobe.exe  "
221,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4732,None,"A member was added to a security-enabled local group.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Member:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1001   Account Name:  -    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Additional Information:   Privileges:  -   Expiration time:  (null)  "
220,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x450   Process Name:  C:\Windows\System32\oobe\msoobe.exe  "
219,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x450   Process Name:  C:\Windows\System32\oobe\msoobe.exe  "
218,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4724,None,"An attempt was made to reset an account's password.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1001   Account Name:  defaultuser0   Account Domain:  MSEDGEWIN10  "
217,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4738,None,"A user account was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1001   Account Name:  defaultuser0   Account Domain:  MSEDGEWIN10    Changed Attributes:   SAM Account Name: defaultuser0   Display Name:  <value not set>     User Principal Name: -   Home Directory:  <value not set>     Home Drive:  <value not set>     Script Path:  <value not set>     Profile Path:  <value not set>     User Workstations: <value not set>     Password Last Set: 10/17/2017 11:13:21 AM   Account Expires:  <never>     Primary Group ID: 513   AllowedToDelegateTo: -   Old UAC Value:  0x14   New UAC Value:  0x214   User Account Control:     'Don't Expire Password' - Enabled     User Parameters: -   SID History:  -   Logon Hours:  All      Additional Information:   Privileges:  -  "
216,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4724,None,"An attempt was made to reset an account's password.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1001   Account Name:  defaultuser0   Account Domain:  MSEDGEWIN10  "
215,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4738,None,"A user account was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1001   Account Name:  defaultuser0   Account Domain:  MSEDGEWIN10    Changed Attributes:   SAM Account Name: defaultuser0   Display Name:  <value not set>     User Principal Name: -   Home Directory:  <value not set>     Home Drive:  <value not set>     Script Path:  <value not set>     Profile Path:  <value not set>     User Workstations: <value not set>     Password Last Set: 10/17/2017 11:13:21 AM   Account Expires:  <never>     Primary Group ID: 513   AllowedToDelegateTo: -   Old UAC Value:  0x14   New UAC Value:  0x14   User Account Control: -   User Parameters: -   SID History:  -   Logon Hours:  All      Additional Information:   Privileges:  -  "
214,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4738,None,"A user account was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1001   Account Name:  defaultuser0   Account Domain:  MSEDGEWIN10    Changed Attributes:   SAM Account Name: defaultuser0   Display Name:  <value not set>     User Principal Name: -   Home Directory:  <value not set>     Home Drive:  <value not set>     Script Path:  <value not set>     Profile Path:  <value not set>     User Workstations: <value not set>     Password Last Set: <never>     Account Expires:  <never>     Primary Group ID: 513   AllowedToDelegateTo: -   Old UAC Value:  0x15   New UAC Value:  0x14   User Account Control:     Account Enabled     User Parameters: <value not set>     SID History:  -   Logon Hours:  All      Additional Information:   Privileges:  -  "
213,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4722,None,"A user account was enabled.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1001   Account Name:  defaultuser0   Account Domain:  MSEDGEWIN10  "
212,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4732,None,"A member was added to a security-enabled local group.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Member:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1001   Account Name:  -    Group:   Security ID:  S-1-5-32-545   Group Name:  Users   Group Domain:  Builtin    Additional Information:   Privileges:  -   Expiration time:  (null)  "
211,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4720,None,"A user account was created.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    New Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1001   Account Name:  defaultuser0   Account Domain:  MSEDGEWIN10    Attributes:   SAM Account Name: defaultuser0   Display Name:  <value not set>     User Principal Name: -   Home Directory:  <value not set>     Home Drive:  <value not set>     Script Path:  <value not set>     Profile Path:  <value not set>     User Workstations: <value not set>     Password Last Set: <never>     Account Expires:  <never>     Primary Group ID: 513   Allowed To Delegate To: -   Old UAC Value:  0x0   New UAC Value:  0x15   User Account Control:     Account Disabled      'Password Not Required' - Enabled      'Normal Account' - Enabled     User Parameters: <value not set>     SID History:  -   Logon Hours:  All      Additional Information:   Privileges  -  "
210,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4728,None,"A member was added to a security-enabled global group.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Member:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1001   Account Name:  -    Group:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-513   Group Name:  None   Group Domain:  MSEDGEWIN10    Additional Information:   Privileges:  -  Expiration time:  (null)  "
209,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
208,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:21 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
207,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:20 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x554   Process Name:  C:\Windows\System32\svchost.exe  "
206,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:20 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-20   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e4    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x554   Process Name:  C:\Windows\System32\svchost.exe  "
205,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:20 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-551   Group Name:  Backup Operators   Group Domain:  Builtin    Process Information:   Process ID:  0x4d8   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
204,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:20 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Process Information:   Process ID:  0x4d8   Process Name:  C:\Windows\System32\SearchIndexer.exe  "
203,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:20 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
202,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:20 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
201,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:19 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
200,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:19 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
199,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:19 AM,4724,None,"An attempt was made to reset an account's password.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-500   Account Name:  Administrator   Account Domain:  MSEDGEWIN10  "
198,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:19 AM,4738,None,"A user account was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-500   Account Name:  Administrator   Account Domain:  MSEDGEWIN10    Changed Attributes:   SAM Account Name: Administrator   Display Name:  <value not set>     User Principal Name: -   Home Directory:  <value not set>     Home Drive:  <value not set>     Script Path:  <value not set>     Profile Path:  <value not set>     User Workstations: <value not set>     Password Last Set: 10/17/2017 11:13:19 AM   Account Expires:  <never>     Primary Group ID: 513   AllowedToDelegateTo: -   Old UAC Value:  0x211   New UAC Value:  0x211   User Account Control: -   User Parameters: -   SID History:  -   Logon Hours:  All      Additional Information:   Privileges:  -  "
197,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:19 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-500   Account Name:  Administrator   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x43c   Process Name:  C:\Windows\System32\rundll32.exe  "
196,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:19 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-500   Account Name:  Administrator   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x43c   Process Name:  C:\Windows\System32\rundll32.exe  "
195,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:19 AM,4739,None,"Domain Policy was changed.    Change Type:  Password Policy modified    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Domain:   Domain Name:  MSEDGEWIN10   Domain ID:  S-1-5-21-4233833229-2203495600-2027003190    Changed Attributes:   Min. Password Age: ?   Max. Password Age: ?   Force Logoff:  ?   Lockout Threshold: ?   Lockout Observation Window: ?   Lockout Duration: ?   Password Properties: ?   Min. Password Length: ?   Password History Length: -   Machine Account Quota: -   Mixed Domain Mode: -   Domain Behavior Version: -   OEM Information: 0    Additional Information:   Privileges:  -  "
194,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:19 AM,4732,None,"A member was added to a security-enabled local group.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Member:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  -    Group:   Security ID:  S-1-5-32-544   Group Name:  Administrators   Group Domain:  Builtin    Additional Information:   Privileges:  -   Expiration time:  (null)  "
193,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:19 AM,4724,None,"An attempt was made to reset an account's password.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10  "
192,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:19 AM,4738,None,"A user account was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Changed Attributes:   SAM Account Name: IEUser   Display Name:  IEUser   User Principal Name: -   Home Directory:  <value not set>     Home Drive:  <value not set>     Script Path:  <value not set>     Profile Path:  <value not set>     User Workstations: <value not set>     Password Last Set: 10/17/2017 11:13:19 AM   Account Expires:  <never>     Primary Group ID: 513   AllowedToDelegateTo: -   Old UAC Value:  0x14   New UAC Value:  0x10   User Account Control:     'Password Not Required' - Disabled     User Parameters: -   SID History:  -   Logon Hours:  All      Additional Information:   Privileges:  -  "
191,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:19 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x43c   Process Name:  C:\Windows\System32\rundll32.exe  "
190,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:19 AM,4798,None,"A user's local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    User:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Process Information:   Process ID:  0x43c   Process Name:  C:\Windows\System32\rundll32.exe  "
189,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:19 AM,4739,None,"Domain Policy was changed.    Change Type:  Password Policy modified    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Domain:   Domain Name:  MSEDGEWIN10   Domain ID:  S-1-5-21-4233833229-2203495600-2027003190    Changed Attributes:   Min. Password Age: ?   Max. Password Age: ?   Force Logoff:  ?   Lockout Threshold: ?   Lockout Observation Window: ?   Lockout Duration: ?   Password Properties: ?   Min. Password Length: ?   Password History Length: -   Machine Account Quota: -   Mixed Domain Mode: -   Domain Behavior Version: -   OEM Information: 0    Additional Information:   Privileges:  -  "
188,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:19 AM,4732,None,"A member was added to a security-enabled local group.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Member:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  -    Group:   Security ID:  S-1-5-32-545   Group Name:  Users   Group Domain:  Builtin    Additional Information:   Privileges:  -   Expiration time:  (null)  "
187,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:19 AM,4738,None,"A user account was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Changed Attributes:   SAM Account Name: IEUser   Display Name:  IEUser   User Principal Name: -   Home Directory:  <value not set>     Home Drive:  <value not set>     Script Path:  <value not set>     Profile Path:  <value not set>     User Workstations: <value not set>     Password Last Set: <never>     Account Expires:  <never>     Primary Group ID: 513   AllowedToDelegateTo: -   Old UAC Value:  0x15   New UAC Value:  0x14   User Account Control:     Account Enabled     User Parameters: <value not set>     SID History:  -   Logon Hours:  All      Additional Information:   Privileges:  -  "
186,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:19 AM,4722,None,"A user account was enabled.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10  "
185,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:19 AM,4720,None,"A user account was created.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    New Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  IEUser   Account Domain:  MSEDGEWIN10    Attributes:   SAM Account Name: IEUser   Display Name:  <value not set>     User Principal Name: -   Home Directory:  <value not set>     Home Drive:  <value not set>     Script Path:  <value not set>     Profile Path:  <value not set>     User Workstations: <value not set>     Password Last Set: <never>     Account Expires:  <never>     Primary Group ID: 513   Allowed To Delegate To: -   Old UAC Value:  0x0   New UAC Value:  0x15   User Account Control:     Account Disabled      'Password Not Required' - Enabled      'Normal Account' - Enabled     User Parameters: <value not set>     SID History:  -   Logon Hours:  All      Additional Information:   Privileges  -  "
184,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:19 AM,4728,None,"A member was added to a security-enabled global group.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Member:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-1000   Account Name:  -    Group:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-513   Group Name:  None   Group Domain:  MSEDGEWIN10    Additional Information:   Privileges:  -  Expiration time:  (null)  "
183,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:13 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
182,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:13 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
181,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
180,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
179,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
178,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
177,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xba9d    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
176,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0xba9d   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1f0   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
175,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  DWM-1   Account Domain:  Window Manager   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1f0   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
174,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
173,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
172,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
171,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
170,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
169,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
168,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
167,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x234   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
166,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-1   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon ID:  0x7463   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1f0   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
165,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1f0   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
164,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-0   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon ID:  0x7454   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1b0   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
163,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MSEDGEWIN10$   Account Domain:  WORKGROUP   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1b0   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
162,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4902,None,"The Per-user audit policy table was created.    Number of Elements: 0  Policy ID: 0x72a0  "
161,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Logon Information:   Logon Type:  0   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  -    New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4   Process Name:  ?    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  -   Authentication Package: -   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
160,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4608,None,"Windows is starting up.    This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.  "
159,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x23c   New Process Name: ??????????????e??? ????????? ???????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1b0   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
158,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x234   New Process Name: ????????????????-??6??0????0--?0???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1b0   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
157,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1f0   New Process Name: ????????????????-??6??8????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1a8   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
156,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1b8   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1a8   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
155,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1b0   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x158   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
154,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:12 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1a8   New Process Name: ??????????????-??6??0????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x110   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
153,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:11 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x160   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x158   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
152,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:11 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x158   New Process Name: ??????????????-??6??0????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x110   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
151,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:11 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x124   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x110   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
150,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:10 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x110   New Process Name: ??????????????-??6?4????0--?0???????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x4   Creator Process Name: ???????   Process Command Line: ????0--?0???????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
149,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,MSEDGEWIN10,10/17/2017 10:13:10 AM,4826,None,"Boot Configuration Data loaded.    Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    General Settings:   Load Options:  -   Advanced Options:  No     Configuration Access Policy: Default     System Event Logging: No     Kernel Debugging: No     VSM Launch Type: Off      Signature Settings:   Test Signing:  No     Flight Signing:  No     Disable Integrity Checks: No      HyperVisor Settings:   HyperVisor Load Options: -   HyperVisor Launch Type: Off     HyperVisor Debugging: No    "
148,Security,Microsoft-Windows-Eventlog,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:12:56 AM,1100,None,"The event logging service has shut down.  "
147,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:12:54 AM,4616,None,"The system time was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Process Information:   Process ID: 0xe7c   Name:  C:\Windows\System32\rundll32.exe    Previous Time:  2017-10-17T18:12:55.022213200Z  New Time:  2017-10-17T18:12:55.010000000Z    This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.  "
146,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:12:51 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
145,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:12:51 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
144,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:12:51 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
143,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:12:51 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
142,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:12:50 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
141,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:12:50 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
140,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:12:50 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
139,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:12:50 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
138,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:12:50 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
137,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:12:50 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
136,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:12:49 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
135,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:12:49 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
134,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:12:45 AM,4907,None,"Auditing settings on object were changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Object:   Object Server: Security   Object Type: File   Object Name: C:\Windows\Temp\winre\ExtractedFromWim   Handle ID: 0x290    Process Information:   Process ID: 0x3b0   Process Name: C:\Windows\System32\oobe\Setup.exe    Auditing Settings:   Original Security Descriptor: ?   New Security Descriptor:  S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)  "
133,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:12:45 AM,4738,None,"A user account was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-500   Account Name:  Administrator   Account Domain:  MINWINPC    Changed Attributes:   SAM Account Name: -   Display Name:  -   User Principal Name: -   Home Directory:  -   Home Drive:  -   Script Path:  -   Profile Path:  -   User Workstations: -   Password Last Set: -   Account Expires:  -   Primary Group ID: -   AllowedToDelegateTo: -   Old UAC Value:  0x211   New UAC Value:  0x211   User Account Control: -   User Parameters: -   SID History:  -   Logon Hours:  -    Additional Information:   Privileges:  -  "
132,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:43 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
131,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:43 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
130,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:43 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
129,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:43 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
128,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:42 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
127,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:42 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
126,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:42 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
125,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:42 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
124,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:37 AM,5024,None,"The Windows Firewall service started successfully.  "
123,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:37 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
122,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:37 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
121,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:37 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
120,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:37 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
119,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:37 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
118,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:37 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
117,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:37 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
116,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:37 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
115,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:37 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
114,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:37 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
113,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:37 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
112,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:37 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
111,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:37 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
110,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:37 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
109,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:37 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
108,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:37 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
107,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:36 AM,5033,None,"The Windows Firewall Driver started successfully.  "
106,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:36 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
105,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:36 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
104,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:36 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
103,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:36 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
102,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
101,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
100,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
099,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
098,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
097,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
096,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
095,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
094,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
093,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
092,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
091,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
090,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
089,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
088,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4738,None,"A user account was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-501   Account Name:  Guest   Account Domain:  MINWINPC    Changed Attributes:   SAM Account Name: -   Display Name:  -   User Principal Name: -   Home Directory:  -   Home Drive:  -   Script Path:  -   Profile Path:  -   User Workstations: -   Password Last Set: -   Account Expires:  -   Primary Group ID: -   AllowedToDelegateTo: -   Old UAC Value:  0x214   New UAC Value:  0x215   User Account Control:     Account Disabled     User Parameters: -   SID History:  -   Logon Hours:  -    Additional Information:   Privileges:  -  "
087,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4725,None,"A user account was disabled.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-501   Account Name:  Guest   Account Domain:  MINWINPC  "
086,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4738,None,"A user account was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-500   Account Name:  Administrator   Account Domain:  MINWINPC    Changed Attributes:   SAM Account Name: -   Display Name:  -   User Principal Name: -   Home Directory:  -   Home Drive:  -   Script Path:  -   Profile Path:  -   User Workstations: -   Password Last Set: -   Account Expires:  -   Primary Group ID: -   AllowedToDelegateTo: -   Old UAC Value:  0x210   New UAC Value:  0x211   User Account Control:     Account Disabled     User Parameters: -   SID History:  -   Logon Hours:  -    Additional Information:   Privileges:  -  "
085,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4725,None,"A user account was disabled.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-500   Account Name:  Administrator   Account Domain:  MINWINPC  "
084,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4739,None,"Domain Policy was changed.    Change Type:  Password Policy modified    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Domain:   Domain Name:  MINWINPC   Domain ID:  S-1-5-21-4233833229-2203495600-2027003190    Changed Attributes:   Min. Password Age: ?   Max. Password Age: ?   Force Logoff:  ?   Lockout Threshold: ?   Lockout Observation Window: ?   Lockout Duration: ?   Password Properties: ?   Min. Password Length: ?   Password History Length: -   Machine Account Quota: -   Mixed Domain Mode: -   Domain Behavior Version: -   OEM Information: 0    Additional Information:   Privileges:  -  "
083,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4732,None,"A member was added to a security-enabled local group.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Member:   Security ID:  S-1-5-11   Account Name:  -    Group:   Security ID:  S-1-5-32-545   Group Name:  Users   Group Domain:  Builtin    Additional Information:   Privileges:  -   Expiration time:  (null)  "
082,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4732,None,"A member was added to a security-enabled local group.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Member:   Security ID:  S-1-5-4   Account Name:  -    Group:   Security ID:  S-1-5-32-545   Group Name:  Users   Group Domain:  Builtin    Additional Information:   Privileges:  -   Expiration time:  (null)  "
081,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4799,None,"A security-enabled local group membership was enumerated.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-545   Group Name:  Users   Group Domain:  Builtin    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe  "
080,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4717,None,"System security access was granted to an account.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Account Modified:   Account Name:  S-1-5-80-0    Access Granted:   Access Right:  SeServiceLogonRight  "
079,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4717,None,"System security access was granted to an account.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Account Modified:   Account Name:  S-1-5-32-555    Access Granted:   Access Right:  SeRemoteInteractiveLogonRight  "
078,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4718,None,"System security access was removed from an account.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Account Modified:   Account Name:  S-1-5-90-0    Access Removed:   Access Right:  SeInteractiveLogonRight  "
077,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4717,None,"System security access was granted to an account.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Account Modified:   Account Name:  S-1-5-21-4233833229-2203495600-2027003190-501    Access Granted:   Access Right:  SeDenyNetworkLogonRight  "
076,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4717,None,"System security access was granted to an account.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Account Modified:   Account Name:  S-1-5-21-4233833229-2203495600-2027003190-501    Access Granted:   Access Right:  SeDenyInteractiveLogonRight  "
075,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4717,None,"System security access was granted to an account.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Account Modified:   Account Name:  S-1-5-21-4233833229-2203495600-2027003190-501    Access Granted:   Access Right:  SeInteractiveLogonRight  "
074,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4718,None,"System security access was removed from an account.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Account Modified:   Account Name:  S-1-1-0    Access Removed:   Access Right:  SeRemoteInteractiveLogonRight  "
073,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4718,None,"System security access was removed from an account.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Account Modified:   Account Name:  S-1-1-0    Access Removed:   Access Right:  SeInteractiveLogonRight  "
072,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4717,None,"System security access was granted to an account.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Account Modified:   Account Name:  S-1-5-32-559    Access Granted:   Access Right:  SeBatchLogonRight  "
071,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4717,None,"System security access was granted to an account.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Account Modified:   Account Name:  S-1-5-32-551    Access Granted:   Access Right:  SeBatchLogonRight  "
070,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4717,None,"System security access was granted to an account.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Account Modified:   Account Name:  S-1-5-32-551    Access Granted:   Access Right:  SeNetworkLogonRight  "
069,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4717,None,"System security access was granted to an account.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Account Modified:   Account Name:  S-1-5-32-544    Access Granted:   Access Right:  SeRemoteInteractiveLogonRight  "
068,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4718,None,"System security access was removed from an account.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Account Modified:   Account Name:  S-1-5-32-581    Access Removed:   Access Right:  SeNetworkLogonRight  "
067,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4718,None,"System security access was removed from an account.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Account Modified:   Account Name:  S-1-5-32-581    Access Removed:   Access Right:  SeInteractiveLogonRight  "
066,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4718,None,"System security access was removed from an account.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Account Modified:   Account Name:  S-1-5-32-546    Access Removed:   Access Right:  SeInteractiveLogonRight  "
065,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:27 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
064,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-19   Account Name:  LOCAL SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e5   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
063,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:27 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
062,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
061,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:27 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
060,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
059,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:27 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0x13770    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
058,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:27 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-90-0-1   Account Name:  DWM-1   Account Domain:  Window Manager   Logon ID:  0x13770   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x220   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
057,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:27 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  DWM-1   Account Domain:  Window Manager   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x220   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
056,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
055,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
054,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4    Privileges:  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  "
053,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-20   Account Name:  NETWORK SERVICE   Account Domain:  NT AUTHORITY   Logon ID:  0x3e4   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
052,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
051,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
050,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4634,None,"An account was logged off.    Subject:   Security ID:  S-1-5-96-0-0   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon ID:  0xd36d    Logon Type:   2    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.  "
049,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-1   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon ID:  0xd3a9   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x220   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
048,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-1   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x220   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
047,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  2   Restricted Admin Mode: -   Virtual Account:  Yes     Elevated Token:  No      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-96-0-0   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon ID:  0xd36d   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1bc   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
046,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4648,None,"A logon was attempted using explicit credentials.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Account Whose Credentials Were Used:   Account Name:  UMFD-0   Account Domain:  Font Driver Host   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Target Server:   Target Server Name: localhost   Additional Information: localhost    Process Information:   Process ID:  0x1bc   Process Name:  C:\Windows\System32\wininit.exe    Network Information:   Network Address: -   Port:   -    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.  "
045,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4672,None,"Special privileges assigned to new logon.    Subject:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7    Privileges:  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege     SeDelegateSessionUserImpersonatePrivilege  "
044,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Logon Information:   Logon Type:  5   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  Impersonation      New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x248   Process Name:  C:\Windows\System32\services.exe    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  Advapi     Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
043,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4738,None,"A user account was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-504   Account Name:  WDAGUtilityAccount   Account Domain:  MINWINPC    Changed Attributes:   SAM Account Name: -   Display Name:  -   User Principal Name: -   Home Directory:  -   Home Drive:  -   Script Path:  -   Profile Path:  -   User Workstations: -   Password Last Set: -   Account Expires:  -   Primary Group ID: -   AllowedToDelegateTo: -   Old UAC Value:  -   New UAC Value:  -   User Account Control: -   User Parameters: -   SID History:  -   Logon Hours:  -    Additional Information:   Privileges:  -  "
042,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4738,None,"A user account was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-504   Account Name:  WDAGUtilityAccount   Account Domain:  MINWINPC    Changed Attributes:   SAM Account Name: -   Display Name:  -   User Principal Name: -   Home Directory:  -   Home Drive:  -   Script Path:  -   Profile Path:  -   User Workstations: -   Password Last Set: -   Account Expires:  -   Primary Group ID: -   AllowedToDelegateTo: -   Old UAC Value:  -   New UAC Value:  -   User Account Control: -   User Parameters: -   SID History:  -   Logon Hours:  -    Additional Information:   Privileges:  -  "
041,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4738,None,"A user account was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Target Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-504   Account Name:  WDAGUtilityAccount   Account Domain:  MINWINPC    Changed Attributes:   SAM Account Name: -   Display Name:  -   User Principal Name: -   Home Directory:  -   Home Drive:  -   Script Path:  -   Profile Path:  -   User Workstations: -   Password Last Set: -   Account Expires:  -   Primary Group ID: -   AllowedToDelegateTo: -   Old UAC Value:  0x15   New UAC Value:  0x11   User Account Control:     'Password Not Required' - Disabled     User Parameters: -   SID History:  -   Logon Hours:  -    Additional Information:   Privileges:  -  "
040,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4720,None,"A user account was created.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    New Account:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-504   Account Name:  WDAGUtilityAccount   Account Domain:  MINWINPC    Attributes:   SAM Account Name: WDAGUtilityAccount   Display Name:  <value not set>     User Principal Name: -   Home Directory:  <value not set>     Home Drive:  <value not set>     Script Path:  <value not set>     Profile Path:  <value not set>     User Workstations: <value not set>     Password Last Set: <never>     Account Expires:  <never>     Primary Group ID: 513   Allowed To Delegate To: -   Old UAC Value:  0x0   New UAC Value:  0x15   User Account Control:     Account Disabled      'Password Not Required' - Enabled      'Normal Account' - Enabled     User Parameters: <value not set>     SID History:  -   Logon Hours:  All      Additional Information:   Privileges  -  "
039,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4728,None,"A member was added to a security-enabled global group.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Member:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-504   Account Name:  -    Group:   Security ID:  S-1-5-21-4233833229-2203495600-2027003190-513   Group Name:  None   Group Domain:  MINWINPC    Additional Information:   Privileges:  -  Expiration time:  (null)  "
038,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-580   Group Name:  Remote Management Users   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
037,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4731,None,"A security-enabled local group was created.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    New Group:   Security ID:  S-1-5-32-580   Group Name:  Remote Management Users   Group Domain:  Builtin    Attributes:   SAM Account Name: Remote Management Users   SID History:  -    Additional Information:   Privileges:  -  "
036,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-579   Group Name:  Access Control Assistance Operators   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
035,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4731,None,"A security-enabled local group was created.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    New Group:   Security ID:  S-1-5-32-579   Group Name:  Access Control Assistance Operators   Group Domain:  Builtin    Attributes:   SAM Account Name: Access Control Assistance Operators   SID History:  -    Additional Information:   Privileges:  -  "
034,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-578   Group Name:  Hyper-V Administrators   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
033,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4731,None,"A security-enabled local group was created.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    New Group:   Security ID:  S-1-5-32-578   Group Name:  Hyper-V Administrators   Group Domain:  Builtin    Attributes:   SAM Account Name: Hyper-V Administrators   SID History:  -    Additional Information:   Privileges:  -  "
032,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-573   Group Name:  Event Log Readers   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
031,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4731,None,"A security-enabled local group was created.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    New Group:   Security ID:  S-1-5-32-573   Group Name:  Event Log Readers   Group Domain:  Builtin    Attributes:   SAM Account Name: Event Log Readers   SID History:  -    Additional Information:   Privileges:  -  "
030,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4732,None,"A member was added to a security-enabled local group.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Member:   Security ID:  S-1-5-17   Account Name:  -    Group:   Security ID:  S-1-5-32-568   Group Name:  IIS_IUSRS   Group Domain:  Builtin    Additional Information:   Privileges:  -   Expiration time:  (null)  "
029,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-569   Group Name:  Cryptographic Operators   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
028,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4731,None,"A security-enabled local group was created.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    New Group:   Security ID:  S-1-5-32-569   Group Name:  Cryptographic Operators   Group Domain:  Builtin    Attributes:   SAM Account Name: Cryptographic Operators   SID History:  -    Additional Information:   Privileges:  -  "
027,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-568   Group Name:  IIS_IUSRS   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
026,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4731,None,"A security-enabled local group was created.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    New Group:   Security ID:  S-1-5-32-568   Group Name:  IIS_IUSRS   Group Domain:  Builtin    Attributes:   SAM Account Name: IIS_IUSRS   SID History:  -    Additional Information:   Privileges:  -  "
025,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-562   Group Name:  Distributed COM Users   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
024,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4731,None,"A security-enabled local group was created.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    New Group:   Security ID:  S-1-5-32-562   Group Name:  Distributed COM Users   Group Domain:  Builtin    Attributes:   SAM Account Name: Distributed COM Users   SID History:  -    Additional Information:   Privileges:  -  "
023,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-559   Group Name:  Performance Log Users   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
022,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4731,None,"A security-enabled local group was created.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    New Group:   Security ID:  S-1-5-32-559   Group Name:  Performance Log Users   Group Domain:  Builtin    Attributes:   SAM Account Name: Performance Log Users   SID History:  -    Additional Information:   Privileges:  -  "
021,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-558   Group Name:  Performance Monitor Users   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
020,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4731,None,"A security-enabled local group was created.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    New Group:   Security ID:  S-1-5-32-558   Group Name:  Performance Monitor Users   Group Domain:  Builtin    Attributes:   SAM Account Name: Performance Monitor Users   SID History:  -    Additional Information:   Privileges:  -  "
019,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-556   Group Name:  Network Configuration Operators   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
018,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4731,None,"A security-enabled local group was created.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    New Group:   Security ID:  S-1-5-32-556   Group Name:  Network Configuration Operators   Group Domain:  Builtin    Attributes:   SAM Account Name: Network Configuration Operators   SID History:  -    Additional Information:   Privileges:  -  "
017,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4735,None,"A security-enabled local group was changed.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    Group:   Security ID:  S-1-5-32-555   Group Name:  Remote Desktop Users   Group Domain:  Builtin    Changed Attributes:   SAM Account Name: -   SID History:  -    Additional Information:   Privileges:  -  "
016,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4731,None,"A security-enabled local group was created.    Subject:   Security ID:  S-1-5-18   Account Name:  MINWINPC$   Account Domain:  ?   Logon ID:  0x3e7    New Group:   Security ID:  S-1-5-32-555   Group Name:  Remote Desktop Users   Group Domain:  Builtin    Attributes:   SAM Account Name: Remote Desktop Users   SID History:  -    Additional Information:   Privileges:  -  "
015,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4902,None,"The Per-user audit policy table was created.    Number of Elements: 0  Policy ID: 0xcea1  "
014,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4624,None,"An account was successfully logged on.    Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Logon Information:   Logon Type:  0   Restricted Admin Mode: -   Virtual Account:  No     Elevated Token:  Yes      Impersonation Level:  -    New Logon:   Security ID:  S-1-5-18   Account Name:  SYSTEM   Account Domain:  NT AUTHORITY   Logon ID:  0x3e7   Linked Logon ID:  0x0   Network Account Name: -   Network Account Domain: -   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x4   Process Name:  ?    Network Information:   Workstation Name: -   Source Network Address: -   Source Port:  -    Detailed Authentication Information:   Logon Process:  -   Authentication Package: -   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The impersonation level field indicates the extent to which a process in the logon session can impersonate.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  "
013,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4608,None,"Windows is starting up.    This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.  "
012,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x254   New Process Name: ??????????????e??? ????????? ???????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1bc   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
011,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:26 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x248   New Process Name: ????????????????-??6??c????0--?0???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1bc   Creator Process Name: ???????????????e??????   Process Command Line: ????0--?0???????????????e??????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
010,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:25 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x220   New Process Name: ????????????????-??6??4????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1b4   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
009,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:25 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1c4   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x1b4   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
008,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:25 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1bc   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x170   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
007,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:25 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x1b4   New Process Name: ??????????????-??6??c????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x11c   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
006,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:25 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x178   New Process Name: ??????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x170   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
005,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:25 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x170   New Process Name: ??????????????-??6??c????0--?0????????????????????4?   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x11c   Creator Process Name: ????????????????????4?   Process Command Line: ????0--?0????????????????????4?    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
004,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:25 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x160   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x11c   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
003,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:24 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x12c   New Process Name: ???????????????e??? ????????? ???????????????e??????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x11c   Creator Process Name: ????????????????????4   Process Command Line: ????0--?0????????????????????4    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
002,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:23 AM,4688,None,"A new process has been created.    Creator Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    Target Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain:  -   Logon ID:  0x0    Process Information:   New Process ID:  0x11c   New Process Name: ??????????????-??6?4????0--?0???????   Token Elevation Type: TokenElevationTypeDefault (1)     Mandatory Label:  S-1-16-16384   Creator Process ID: 0x4   Creator Process Name: ???????   Process Command Line: ????0--?0???????    Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.    Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.    Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.    Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.  "
001,Security,Microsoft-Windows-Security-Auditing,SUCCESS AUDIT,IEUSER-Q61L06H5,10/17/2017 10:11:23 AM,4826,None,"Boot Configuration Data loaded.    Subject:   Security ID:  S-1-5-18   Account Name:  -   Account Domain:  -   Logon ID:  0x3e7    General Settings:   Load Options:  -   Advanced Options:  No     Configuration Access Policy: Default     System Event Logging: No     Kernel Debugging: No     VSM Launch Type: Off      Signature Settings:   Test Signing:  No     Flight Signing:  No     Disable Integrity Checks: No      HyperVisor Settings:   HyperVisor Load Options: -   HyperVisor Launch Type: Off     HyperVisor Debugging: No    "
